Detect Cobalt Strike beacon network activity

Detect Cobalt Strike beacon network activity

When hunting ransomware C2 infrastructure using TLS fingerprints and beacon timing.

• · Zeek ssl.log or PCAP
• · HTTP request logs

• · JSON beacon confidence scores
• · TLS fingerprints
• · timing analysis

• · Zeek
• · Suricata
• · RITA
• · Python PCAP tools (scapy, dpkt)

Network captures or Zeek logs available; threat intelligence feeds loaded

False positives from legitimate TLS configs; beacon jitter defeats timing analysis; encrypted traffic opacity

• · mukul975/Anthropic-Cybersecurity-Skills
• · NIST/MITRE ATT&CK alignment