hunting-for-cobalt-strike-beacons

What problem does it solve?

Detects cobalt strike beacon activity in network traffic by correlating TLS fingerprints, JA3S/JARM hashes, HTTP C2 profiles, and beacon timing analysis.

Core Features & Use Cases

• Detection of default TLS certificate and JA3S/JARM fingerprints
• HTTP malleable C2 profile matching and timing-based beacon scoring
• Generates structured reports with suspect destinations and actionable guidance
• Applicable to SOC threat hunts, incident response, and blue-team exercises

Quick Start

Run the hunter against Zeek logs to produce a structured beacon detection report.