Core Security Cobalt Strike vs Serving Random Payloads with Apache mod_rewrite (2026)