Zeek x509: Default Cobalt Strike certificate serial observed in HTTPS traffic
Flags Zeek x509 certificates used in HTTPS when the certificate serial matches a known default Cobalt Strike value.
FreeReviewedSigma · High · v2
- Product
- zeek
- Service
- x509
- Author
- Bhabesh Raj (SigmaHQ), DRL 1.1
- Published
- 2021-06-23
- Updated
- 2026-07-31
What it detects
This rule flags HTTPS traffic where the observed x509 certificate serial number matches a known default value associated with Cobalt Strike. Attackers may reuse these default certificates for their C2 infrastructure, making this a useful indicator when certificate telemetry is available. It relies on Zeek x509-derived certificate fields present in the environment’s HTTPS and certificate logging.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
zeek-x509-default-cobalt-strike-certificate-serial-in-https-traffic-7100f7e3
title: "Zeek x509: Default Cobalt Strike certificate serial observed in HTTPS traffic"
id: 31250a63-7f89-4349-b93e-155c026b28f6
status: test
description: This rule flags HTTPS traffic where the observed x509 certificate serial number matches a known default value associated with Cobalt Strike. Attackers may reuse these default certificates for their C2 infrastructure, making this a useful indicator when certificate telemetry is available. It relies on Zeek x509-derived certificate fields present in the environment’s HTTPS and certificate logging.
references:
- https://sergiusechel.medium.com/improving-the-network-based-detection-of-cobalt-strike-c2-servers-in-the-wild-while-reducing-the-6964205f6468
- https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_default_cobalt_strike_certificate.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-06-23
modified: 2022-10-09
tags:
- attack.command-and-control
- attack.s0154
logsource:
product: zeek
service: x509
detection:
selection:
certificate.serial: 8BB00EE
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 7100f7e3-92ce-4584-b7b7-01b40d3d4118
type: derived