Proxy Detection: Cobalt Strike Malleable C2 Profile HTTP URI/User-Agent/Method Patterns

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule identifies HTTP proxy traffic matching specific request patterns associated with Cobalt Strike malleable C2 profiles, including particular URIs, User-Agent strings, HTTP methods, destination hosts, and (in one case) cookie suffixes. Attackers use malleable profiles to shape command-and-control traffic to blend in with legitimate web requests, making pattern-based detection valuable. The detection relies on proxy log fields such as c-uri, cs-host, cs-method, c-useragent, and cs-cookie to match the defined combinations.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Malicious Renamed Python Interpreter Executing nvidia.py RAT

Malicious Self-Signed TLS Certificate With Exploit Subject via Zeek X509

Suspicious Network Connection From wabmig.exe (Turian Injection)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Proxy Detection: Cobalt Strike Malleable C2 Profile HTTP URI/User-Agent/Method Patterns

Pivot detection · T1071.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

proxy-traffic-matches-cobalt-strike-malleable-profile-indicators-uri-user-agent--f3f21ce1

title: "Proxy Detection: Cobalt Strike Malleable C2 Profile HTTP URI/User-Agent/Method Patterns"
id: 6dc2306d-5134-4d59-abc8-c70b44105d37
related:
  - id: 953b895e-5cc9-454b-b183-7f3db555452e
    type: obsolete
  - id: 41b42a36-f62c-4c34-bd40-8cb804a34ad8
    type: obsolete
  - id: 37325383-740a-403d-b1a2-b2b4ab7992e7
    type: obsolete
  - id: c9b33401-cc6a-4cf6-83bb-57ddcb2407fc
    type: obsolete
  - id: f3f21ce1-cdef-4bfc-8328-ed2e826f5fac
    type: derived
status: test
description: This rule identifies HTTP proxy traffic matching specific request patterns associated with Cobalt Strike malleable C2 profiles, including particular URIs, User-Agent strings, HTTP methods, destination hosts, and (in one case) cookie suffixes. Attackers use malleable profiles to shape command-and-control traffic to blend in with legitimate web requests, making pattern-based detection valuable. The detection relies on proxy log fields such as c-uri, cs-host, cs-method, c-useragent, and cs-cookie to match the defined combinations.
references:
  - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/amazon.profile
  - https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100
  - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/ocsp.profile
  - https://github.com/yeyintminthuhtut/Malleable-C2-Profiles-Collection/
  - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/onedrive_getonly.profile
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_hktl_cobalt_strike_malleable_c2_requests.yml
author: Markus Neis, Florian Roth (Nextron Systems), Huntrule Team
date: 2024-02-15
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection_amazon_1:
    c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    cs-method: GET
    c-uri: /s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
    cs-host: www.amazon.com
    cs-cookie|endswith: =csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996
  selection_amazon_2:
    c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    cs-method: POST
    c-uri: /N4215/adj/amzn.us.sr.aps
    cs-host: www.amazon.com
  selection_generic_1:
    c-useragent:
      - Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)
      - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E )
      - Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2) Java/1.5.0_08
  selection_generic_2:
    c-useragent|endswith: ; MANM; MANM)
  selection_oscp:
    c-uri|contains: /oscp/
    cs-host: ocsp.verisign.com
  selection_onedrive:
    cs-method: GET
    c-uri|endswith: \?manifest=wac
    cs-host: onedrive.live.com
  filter_main_onedrive:
    c-uri|startswith: http
    c-uri|contains: ://onedrive.live.com/
  condition: 1 of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL