Sigma rule: HackTool - CobaltStrike Malleable Profile Patterns - Proxy

Rule

Title

HackTool - CobaltStrike Malleable Profile Patterns - Proxy

Status

test

Level

high

Author

Markus Neis, Florian Roth (Nextron Systems)

Date

2024-02-15

File

rules/web/proxy_generic/proxy_hktl_cobalt_strike_malleable_c2_requests.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).

Log source

category

proxy

Detection

selection_amazon_1:
    c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'
    cs-method: 'GET'
    c-uri: '/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books'
    cs-host: 'www.amazon.com'
    cs-cookie|endswith: '=csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996'
selection_amazon_2:
    c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'
    cs-method: 'POST'
    c-uri: '/N4215/adj/amzn.us.sr.aps'
    cs-host: 'www.amazon.com'
selection_generic_1:
    c-useragent:
        - 'Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)'
        - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E )'
        - 'Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2) Java/1.5.0_08'
selection_generic_2:
    c-useragent|endswith: '; MANM; MANM)'
selection_oscp:
    c-uri|contains: '/oscp/'
    cs-host: 'ocsp.verisign.com'
selection_onedrive:
    cs-method: 'GET'
    c-uri|endswith: '\?manifest=wac'
    cs-host: 'onedrive.live.com'
filter_main_onedrive:
    c-uri|startswith: 'http'
    c-uri|contains: '://onedrive.live.com/'
condition: 1 of selection_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.command-and-control
• attack.t1071.001

MITRE ATT&CK ids this rule names

• T1071.001

Related rules

• 953b895e-5cc9-454b-b183-7f3db555452e (obsolete)
• 41b42a36-f62c-4c34-bd40-8cb804a34ad8 (obsolete)
• 37325383-740a-403d-b1a2-b2b4ab7992e7 (obsolete)
• c9b33401-cc6a-4cf6-83bb-57ddcb2407fc (obsolete)

References

• https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/amazon.profile
• https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100
• https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/ocsp.profile
• https://github.com/yeyintminthuhtut/Malleable-C2-Profiles-Collection/
• https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/onedrive_getonly.profile

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/proxy_generic/proxy_hktl_cobalt_strike_malleable_c2_requests.yml