Our other post touched on Malleable C2 profiles and how threat actors use them however, that was just some of their many applications. This is made possible thanks to Malleable C2 profiles. Before we get into that part, we should first discuss what makes Cobalt Strike so versatile.Ĭobalt Strike’s versatility comes from the ability to change the indicators with each payload. There are a couple of factors that we can utilize to fingerprint any suspicious traffic and subsequent infrastructure. This article will demonstrate how to detect this communication before threat actors accomplish their objectives.

Malware has to contact its C2 server if it is to receive further instructions. We cover topics such as domain fronting, SOCKS proxy, C2 traffic, Sigma rules, JARM, JA3/S, RITA & more.Īs with our previous article, we will highlight the common ways we see threat actors using Cobalt Strike.īig shout-out to for helping put this Part 2 together! Also thanks to, and for reviewing this report.Įven though network monitoring and detection capabilities do not come easy for many organizations, they can generally offer a high return on investment if implemented correctly. In this report, we will focus on the network traffic it produced, and provide some easy wins defenders can be on the look out for to detect beaconing activity. Our previous report on Cobalt Strike focused on the most frequently used capabilities that we had observed.

Cobalt strike trial