Zeek X509: Default Cobalt Strike Certificate Serial in HTTPS Traffic

title: "Zeek X509: Default Cobalt Strike Certificate Serial in HTTPS Traffic"
id: 31250a63-7f89-4349-b93e-155c026b28f6
status: test
description: This rule flags HTTPS traffic where the observed certificate serial matches a specific default value associated with Cobalt Strike. Attackers can reuse default certificate properties to stand up consistent C2 endpoints, making this indicator useful for network-based tracking. The detection relies on Zeek x509 certificate telemetry, specifically the certificate.serial field seen in the traffic.
references:
  - https://sergiusechel.medium.com/improving-the-network-based-detection-of-cobalt-strike-c2-servers-in-the-wild-while-reducing-the-6964205f6468
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_default_cobalt_strike_certificate.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-06-23
modified: 2022-10-09
tags:
  - attack.command-and-control
  - attack.s0154
logsource:
  product: zeek
  service: x509
detection:
  selection:
    certificate.serial: 8BB00EE
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7100f7e3-92ce-4584-b7b7-01b40d3d4118
    type: derived