Cobalt Strike — Detection and Beacon Analysis

What Cobalt Strike Is and Why Detection Matters

• Cobalt Strike is a commercial adversary simulation tool developed by Fortra (formerly HelpSystems). It provides a post-exploitation agent (Beacon), C2 infrastructure, and a suite of attack capabilities — including process injection, keylogging, credential theft, and lateral movement. Analysts detect Beacon activity through Sysmon process creation and named pipe events.
• Cobalt Strike is the single most common C2 framework observed in real-world intrusions. Ransomware groups (LockBit, BlackCat, Ryuk), APTs, and nation-state actors all use Cobalt Strike beacons.
• MITRE ATT&CK maps Cobalt Strike behavior across multiple techniques: T1055 (Process Injection) for Beacon payload injection, T1572 (Protocol Tunneling) for C2 communication, T1071 (Application Layer Protocol) for HTTP/HTTPS/DNS beacons, and T1568 (Dynamic Resolution) for domain fronting.
• Detection is difficult because Cobalt Strike’s Malleable C2 profile allows operators to customize every aspect of beacon traffic — HTTP headers, SSL/TLS certificates, DNS query patterns, and beacon timing — to blend in with legitimate traffic.

Beacon Detection — Network Layer

Beacon Timing — Jitter and Sleep Cycle

Cobalt Strike beacons use a default sleep cycle and jitter. Even with custom profiles, the timing pattern is detectable.

# Default behavior: beacon sleeps for N seconds, then checks in
# With jitter: sleep is randomized within a range
# Example: sleep 60s + jitter 25% → check-in every 45-75 seconds

Detection — inter-packet timing analysis:

SPL query — beacon timing detection:

index=zeek sourcetype=conn.log
| search id.resp_h=*EXTERNAL* AND proto=tcp
| where id.resp_p=443 OR id.resp_p=80
| sort id.orig_h, id.resp_h, ts
| streamstats time_window=10m count(id.resp_h) as beacon_count by id.orig_h, id.resp_h
| where beacon_count > 10
| stats stdev(ts) as timing_jitter, avg(duration) as avg_duration, count by id.orig_h, id.resp_h
| where timing_jitter < 30
| eval alert = "Possible C2 beaconing — " . count . " connections from " . id.orig_h . " to " . id.resp_h . " (jitter: " . round(timing_jitter, 2) . "s)"
| table id.orig_h, id.resp_h, count, timing_jitter, avg_duration, alert
| sort - count

JA3 and JA3S Hashes

JA3 is a hash of the TLS client hello parameters (cipher suites, extensions, elliptic curves). JA3S is the server hello hash. Together, they fingerprint TLS implementations — including Cobalt Strike’s.

Known Cobalt Strike JA3 Hashes (default profiles):

Detection — JA3 hash matching:

index=zeek sourcetype=ssl.log
| lookup cs_ja3_blocklist.csv ja3 AS ja3 OUTPUT confidence
| where confidence > 0
| eval alert = "Cobalt Strike JA3 fingerprint detected: " . ja3 . " (confidence: " . confidence . ")"
| table ts, id.orig_h, id.resp_h, server_name, ja3, confidence, alert

Important caveat: Malleable C2 profiles can change the JA3 hash. Do not rely on JA3 alone — use it as one signal among many.

HTTP Header Analysis

Cobalt Strike’s HTTP beacon uses configurable User-Agent, Cookie, and Accept headers. Default profiles have recognizable patterns.

Detection — HTTP header anomalies (run in Splunk or your SIEM):

index=proxy sourcetype=access_log
| stats values(user_agent) as user_agents, values(cookie) as cookies, count by src_ip, dest_ip, uri
| where mvcount(user_agents) == 1 AND user_agents IN ("Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)", "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0)")
| eval alert = "Suspicious HTTP request from " . src_ip . " to " . dest_ip . " with outdated User-Agent — possible Cobalt Strike"
| table src_ip, dest_ip, uri, user_agents, cookies, count, alert

Beacon Detection — Host Layer

Named Pipe Indicators

Cobalt Strike uses named pipes for communication between Beacon processes and child modules (screenshot, keylogger, Malleable PE). The named pipe names are configurable but defaults are well-known.

Detection — named pipe creation:

index=windows sourcetype="WinEventLog:Sysmon" EventCode=17 OR EventCode=18
| eval PipeName = lower(PipeName)
| where PipeName LIKE "%msagent%" OR PipeName LIKE "%postex%" OR PipeName LIKE "%mypipe%"
| eval alert = "Cobalt Strike named pipe detected: " . PipeName . " on " . Computer
| table _time, Computer, Image, PipeName, alert

Process Injection Patterns

Cobalt Strike injects Beacon payloads into legitimate processes using several techniques. Common target processes:

SPL — detect abnormal rundll32 activity (System Event 4688):

index=windows sourcetype="WinEventLog:Security" EventCode=4688
| search NewProcessName="*rundll32.exe" AND CommandLine!="*"
| where NOT CommandLine LIKE "*\\system32\\*"
| eval alert = "Rundll32 from non-standard path on " . Computer . " — possible Cobalt Strike injection"
| table _time, Computer, NewProcessName, CommandLine, alert

Artifact Kit Detection

Cobalt Strike’s Artifact Kit generates payload executables (shellcode loaders). The default artifacts contain distinctive byte sequences that EDR and AV can detect.

YARA rule — detect Cobalt Strike payload artifacts:

rule CobaltStrike_ReflectiveLoader {
    meta:
        description = "Detects Cobalt Strike reflective DLL loader"
        author = "WYZSec"
        reference = "Known Cobalt Strike artifact pattern"
    strings:
        $reflective = "ReflectiveLoader"
        $beacon = "beacon" nocase
        $pipename = "\\\\.\\pipe\\msagent" nocase
        $sleep = { 48 85 C0 74 05 48 8B 08 EB 03 48 8B 08 } // Sleep token pattern
    condition:
        $reflective or ($beacon and $pipename) or $sleep
}

C2 Detection — DNS Beacon

Cobalt Strike supports DNS beacons as a low-and-slow alternative to HTTP/HTTPS. DNS beacons use TXT, A, or AAAA queries to exfiltrate data and receive commands.

DNS Beacon Patterns

Detection — DNS TXT query analysis:

index=zeek sourcetype=dns.log
| search qtype_name=TXT
| eval domain_length = len(query)
| where domain_length > 30
| stats count by query, id.orig_h
| where count > 5
| eval alert = "Excessive TXT queries to " . query . " from " . id.orig_h . " — possible DNS beacon"
| table id.orig_h, query, count, alert
| sort - count

Detection Reference Table

Mitigation and Hardening

Related

• RITA — detection and response for T1071 techniques
• Sysmon — detection and response for T1654 techniques
• Common Ports and Protocols — covers the common ports and protocols concepts
• DNS — detection and response for T1572, T1568 techniques
• EDR Basics — detection and response for T1059, T1003, T1055, T1204, T1562 techniques

Sources

• MITRE ATT&CK — T1055 (Process Injection)
• MITRE ATT&CK — T1572 (Protocol Tunneling)
• MITRE ATT&CK — T1071 (Application Layer Protocol)
• Cobalt Strike — Malleable C2 Profile Documentation
• Elastic Security — Cobalt Strike Detection Rules
• Florian Roth — Cobalt Strike Detection YARA Rules