Hunting and Detecting Cobalt Strike: The Full Guide

This Sekoia Threat & Detection Lab blog analyzes the widespread malicious use of Cobalt Strike — its client/server architecture, beacon types and Malleable C2 profiles — and provides practical detection and hunting guidance (default SSL certificates, HTTP response quirks, DNS beacon labels, named pipe patterns, default payload names), SIEM rule examples, and mitigation recommendations including real-time detection, memory forensics, EDR/Yara usage, and hardening of PowerShell and Office macro policies.