Proxy traffic matches Cobalt Strike malleable profile indicators (URI, User-Agent, Method)

title: Proxy traffic matches Cobalt Strike malleable profile indicators (URI, User-Agent, Method)
id: 6dc2306d-5134-4d59-abc8-c70b44105d37
related:
  - id: 953b895e-5cc9-454b-b183-7f3db555452e
    type: obsolete
  - id: 41b42a36-f62c-4c34-bd40-8cb804a34ad8
    type: obsolete
  - id: 37325383-740a-403d-b1a2-b2b4ab7992e7
    type: obsolete
  - id: c9b33401-cc6a-4cf6-83bb-57ddcb2407fc
    type: obsolete
  - id: f3f21ce1-cdef-4bfc-8328-ed2e826f5fac
    type: derived
status: test
description: This rule identifies proxy requests that match specific Cobalt Strike malleable profile patterns, including exact or partially matched URI paths, User-Agent strings, HTTP methods, targeted hosts, and (for one selection) a cookie suffix. Attackers can use malleable profiles to disguise command-and-control traffic as legitimate web requests; matching these indicators helps detect that behavioral camouflage. It relies on proxy HTTP telemetry fields such as client user agent, request URI, request method, destination host, and request cookies.
references:
  - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/amazon.profile
  - https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100
  - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/ocsp.profile
  - https://github.com/yeyintminthuhtut/Malleable-C2-Profiles-Collection/
  - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/onedrive_getonly.profile
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_hktl_cobalt_strike_malleable_c2_requests.yml
author: Markus Neis, Florian Roth (Nextron Systems), Huntrule Team
date: 2024-02-15
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection_amazon_1:
    c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    cs-method: GET
    c-uri: /s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
    cs-host: www.amazon.com
    cs-cookie|endswith: =csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996
  selection_amazon_2:
    c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    cs-method: POST
    c-uri: /N4215/adj/amzn.us.sr.aps
    cs-host: www.amazon.com
  selection_generic_1:
    c-useragent:
      - Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)
      - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E )
      - Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2) Java/1.5.0_08
  selection_generic_2:
    c-useragent|endswith: ; MANM; MANM)
  selection_oscp:
    c-uri|contains: /oscp/
    cs-host: ocsp.verisign.com
  selection_onedrive:
    cs-method: GET
    c-uri|endswith: \?manifest=wac
    cs-host: onedrive.live.com
  filter_main_onedrive:
    c-uri|startswith: http
    c-uri|contains: ://onedrive.live.com/
  condition: 1 of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1