How do you detect Cobalt Strike Beacon?

Detect Cobalt Strike Beacon across layers: on the host, hunt default named pipes (msagent_##, postex_####) via Sysmon 17/18 and process injection into sacrificial spawnto processes such as an argument-less rundll32; in memory, schedule YARA scans (Elastic / Florian Roth rule sets) because the sleep mask only obfuscates between check-ins; on the wire, match the team server's default JARM/JA3S, TLS certificate and default profile URIs, and hunt for regular check-in intervals with jitter. Operators customise profiles, so correlate several signals rather than alerting on one default.

Detecting Cobalt Strike Beacon: Profiles, Pipes and Memory

Cobalt Strike Beacon remains the workhorse of ransomware affiliates and red teams alike. Because its tradecraft is so well studied, Beacon is detectable at several layers at once: network profile artifacts, default and operator-named pipes, process-injection behaviour and in-memory structures. This pack pulls those signals together into detections you can run today.

Signals at a Glance

Signal	Where	ATT&CK
Default/weak named pipes (msagent_##, postex_####, status_##)	Sysmon 17/18	T1055
Process injection into spawned rundll32/dllhost (spawnto)	Sysmon 8/10, EDR	T1055.012
Default profile URIs / User-Agent on egress	Proxy, Zeek	T1071.001
Known Beacon JA3S / JARM on C2 server	Network, scan data	T1573.002
Regular check-in interval + jitter to one destination	Flow/proxy	T1571
Beacon config / sleep-mask stub in process memory	Memory scan, EDR	T1027.009

Named Pipes and Injection

Beacon uses named pipes for peer-to-peer (SMB/TCP) links and for post-exploitation jobs. The default and many public profiles leave predictable pipe names. Hunt Sysmon Event ID 17 (pipe created) and 18 (pipe connected):

title: Cobalt Strike Default Named Pipes
logsource:
  product: windows
  category: pipe_created
detection:
  selection:
    PipeName|re: '\\(msagent_..|status_..|postex_....|postex_ssh_....|MSSE-....-server|\\mojo\\.5688)'
  condition: selection
level: high
# Tune: baseline legitimate pipes first; operators can rename pipes,
# so pair with injection + egress signals rather than alerting alone.

Beacon's default spawnto spawns a sacrificial process (often rundll32.exe with no arguments) and injects. Alert on signed Windows binaries that start suspended with no command line and then host injected, RWX memory:

// Microsoft Defender / Sentinel (KQL) - suspicious rundll32 with no args hosting injection
DeviceProcessEvents
| where FileName =~ "rundll32.exe"
| where isempty(ProcessCommandLine) or ProcessCommandLine endswith "rundll32.exe"
| join kind=inner (
    DeviceEvents
    | where ActionType in ("CreateRemoteThread","WriteToLsassProcess","InjectIntoProcess")
) on DeviceId, $left.ProcessId == $right.InitiatingProcessId
| project Timestamp, DeviceName, FileName, ProcessCommandLine, ActionType

Memory and Config

When Beacon sleeps, older versions leave the configuration and payload decrypted in memory between sleep-mask cycles. Periodic memory scanning with community YARA rules still catches a large share of real-world Beacons, and config extractors recover the C2 profile for pivoting:

Scan process memory with the Elastic and Florian Roth Cobalt Strike YARA rule sets; schedule scans rather than relying on on-access only, since sleep-mask obfuscates between beacons.
Run a Beacon config extractor (community tooling) against suspicious memory dumps to recover the C2 server, user-agent, sleep time and jitter — then pivot on that infrastructure.
On the wire, fingerprint the team server: default TLS certificate serial 146473198, default JARM, and the /submit.php style URIs in public profiles.

Vetted sources

Use the SigmaHQ named-pipe and process-injection rules, Elastic and Florian Roth YARA for Cobalt Strike, and the default-profile indicators documented by the community. Always baseline your own environment — operators customise profiles and pipe names, so correlate signals rather than alerting on any single default.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Named Pipes and Injection

Memory and Config

Build Detections That Fire

C2 Beaconing Detection

Detection Hub

Sliver C2 Detection