How do you detect malleable C2 profiles?

Detect malleable C2 profiles two ways. First, match known public and default profile artifacts — distinctive URIs (/submit.php, /dpixel, /ca), reused user-agents and header orderings — because most operators reuse community profiles. Second, hunt the behaviour profiles cannot change: GET-then-POST tasking/exfil with a consistent size relationship on a schedule, a user-agent unique to one host, metadata stuffed into a Cookie or custom header, and a Content-Type that mismatches the body. Pair string matches with beacon timing and destination reputation.

Detecting Malleable C2 Profiles and Default Indicators

Cobalt Strike's malleable C2 profiles let operators shape HTTP(S) traffic — URIs, headers, user-agents, how data is encoded and where it hides. That flexibility defeats static signatures, but most operators reuse public profiles (or leave defaults), and even custom profiles leak structural artifacts. This page covers hunting both.

Signals at a Glance

Artifact	Where	ATT&CK
Default profile URIs (/submit.php, /ca, /dpixel)	Proxy, Zeek	T1071.001
Reused public-profile header/UA combinations	Proxy	T1071.001
Beacon metadata in Cookie / custom header	Proxy	T1071.001
Fixed Content-Type with mismatched body	Proxy	T1001
Consistent request structure + beacon timing	Proxy/flow	T1571

Reused Public Profiles

Thousands of Beacons run known public profiles (Amazon, jQuery, OCSP and others from community repos). Build detections from those profiles' distinctive URIs, user-agents and header orderings — a huge share of real-world Beacon traffic matches one of them:

title: Cobalt Strike Public/Default Malleable Profile URIs
logsource:
  category: proxy
detection:
  uris:
    cs-uri|contains:
      - '/submit.php?id='
      - '/dpixel'
      - '/__utm.gif'
      - '/ca'
      - '/activity'
  ua:
    cs-useragent|contains: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0'
  condition: uris and ua
level: medium
# Public-profile artifacts drift; pair with beacon timing + reputation.

Artifacts Profiles Cannot Hide

Even a bespoke profile cannot change Beacon's fundamental behaviour. Hunt the structure, not the strings:

GET for tasking then POST to exfil with a consistent size relationship, repeated on a schedule.
A user-agent that never appears elsewhere for that host (no real browsing from the same process).
Metadata consistently stuffed into a Cookie or a single custom header on every request.
Static Content-Type that does not match the actual body (e.g. image/jpeg carrying encrypted blobs) — a data-obfuscation tell (T1001).

Vetted sources

Mine public malleable-profile repositories to build URI/header/UA detections, and lean on SigmaHQ proxy rules. The durable signal is structural (request/response shape plus beacon timing), so always pair profile-string matches with timing and destination reputation.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Reused Public Profiles

Artifacts Profiles Cannot Hide

Build Detections That Fire

C2 Beaconing Detection

Detection Hub

Cobalt Strike Beacon Detection