hunting-for-cobalt-strike-beacons

Detect Cobalt Strike beacon activity in Zeek logs by correlating TLS fingerprints, JA3S/JARM hashes, HTTP C2 profiles, and timing analysis. Running the included Python agent script against ssl.log, conn.log, and http.log generates a structured report for incident response.

You can hunt for Cobalt Strike beacons using PCAP-derived data by applying TLS fingerprint and malleable C2 profile matching. The detection workflow processes extracted network traffic to score beacon-like confidence and identify suspect destinations.

JARM hash matching identifies Cobalt Strike C2 traffic by comparing server TLS fingerprints against known default Cobalt Strike certificates. Correlating these hashes with JA3S data and HTTP profile matching improves detection accuracy during threat hunts.

Python 3.9+ is required to run the included agent script for Cobalt Strike beacon detection. The workflow processes Zeek logs including ssl.log, conn.log, and http.log to apply timing analysis and generate actionable incident response reports.

Scoring beacon-like confidence during incident response is best achieved by correlating timing analysis with HTTP malleable C2 profile matching and TLS fingerprints. This multi-signal approach generates structured reports highlighting suspect destinations for blue-team exercises.

Timing analysis limitations arise when Cobalt Strike beacons use randomized jitter or non-default malleable C2 profiles, reducing detection confidence. Correlating multiple signals like JA3S hashes and HTTP profiles is necessary to overcome evasion techniques.