# What does Cobalt Strike activity look like on the network?

Cobalt Strike is a commercial tool for authorised red-team exercises that criminals widely misuse, often in cracked versions, to control compromised machines. On the network its implant, called a beacon, checks in with a team server at a configured interval, usually over HTTPS, sometimes over DNS, or between internal hosts through SMB. Signs include regular connections with jitter to a destination nobody else uses, default or barely changed settings in web requests and certificates, TLS client fingerprints that match published ones for known configurations, and SMB connections between workstations that do not normally talk. Many operators change their configuration to avoid exactly these signs, so behaviour matters more than indicators. NetSenX flags beaconing and lateral movement on every plan, and from the Starter plan compares TLS handshakes with fingerprints of known malware where the agent captures packets, on Linux or as a SPAN/TAP sensor.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-does-cobalt-strike-look-like-on-the-network

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [Is internal port scanning a sign of an intruder?](https://netsenx.com/en/faq/is-internal-port-scanning-a-sign-of-an-intruder)
- [How do we know if someone is guessing passwords on our internal network?](https://netsenx.com/en/faq/how-to-know-if-someone-is-guessing-passwords-internally)
- [How do we detect large uploads to cloud storage from a server?](https://netsenx.com/en/faq/how-to-detect-large-uploads-to-cloud-storage-from-a-server)
- [What is PsExec or admin-share abuse, and why does antivirus not flag it?](https://netsenx.com/en/faq/what-is-psexec-and-admin-share-abuse)
- [Can attackers move through our network with stolen passwords and no malware?](https://netsenx.com/en/faq/can-attackers-move-with-stolen-passwords-and-no-malware)