What does Cobalt Strike activity look like on the network?

Cobalt Strike is a commercial tool for authorised red-team exercises that criminals widely misuse, often in cracked versions, to control compromised machines. On the network its implant, called a beacon, checks in with a team server at a configured interval, usually over HTTPS, sometimes over DNS, or between internal hosts through SMB. Signs include regular connections with jitter to a destination nobody else uses, default or barely changed settings in web requests and certificates, TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. client fingerprints that match published ones for known configurations, and SMB connections between workstations that do not normally talk. Many operators change their configuration to avoid exactly these signs, so behaviour matters more than indicators. NetSenX flags beaconing and lateral movement on every plan, and from the Starter plan compares TLS handshakes with fingerprints of known malware where the agent captures packets, on Linux or as a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it./TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. sensor.

← All 69 questions on Attack techniques explainedAll topics