Sometimes instead of blogging I feel like making a big old Twitter thread, so let's talk about Cobalt Strike for people only vaguely familiar (or misinformed) with the concept. Maybe I'll blog it later.
Cobalt Strike is an adversary enumeration tool used to train teams how to do incident response and threat hunting. It was made by a genius I genuinely like and will not disparage, Raphael Mudge. The first time I met him he flew across the floor air-guitaring in his dress clothes.
A lot of you are familiar with the easy-button hacking tool, Metasploit. Well, he made this shnazzy GUI for Metasploit called Armitage.

But, he realized it was still tough for a lot of defenders to get highly skilled Red Teams to train them. Or sommat, I'm not in his head...
Ask him for his take.

Anyway, our pal made this genuinely incredible software suite called Cobalt Strike that not only does payloads & exploitation + shells, but also allows for team-based command and control and sophisticated scripting. Distributed hacking.
This means that a low-moderately skilled Red Team can run a really impressive, realistic intrusion scenario as a coordinated group with just a few experts to help out as needed.

All the C2 beacons are tidily managed and centralized. C2 profiles can be emulated. It's amazing.
Okay but here's the problem. Cobalt Strike works ... really, really well. It works so well at emulating adversaries that bad guys were like:

"Yo, this would make our skids' lives easier..."

So their real experts worked overtime to crack the (genuinely well-controlled) tool.
So now, for the last few years, we've seen Cobalt Strike pop up all over in real intrusions. It's really good at what it does, and it is tremendously customizable.

People and tools will tell you they can detect it but they just detect pieces, behaviors, and defaults.
So, that sounds really daunting. Like, how do you detect this really sophisticated tool? Well, part of it is understanding how it works. It's still facilitating an intrusion that traverses layers of the kill chain. There are good opportunities to catch it.
Cobalt Strike relies heavily on C2 beaconing. Yes, you can build fancy profiles that look like Amazon or Pandora. Yes, it can beacon at irregular intervals. However, C2 rules still apply, and a lot of adversaries use the defaults. Detecting HTTP, HTTPS, or DNS C2, that's a start.
Cobalt Strike has to be delivered to a system somehow. Yes, that could be hack-fu, but the defaults are old but effective nonsense like phishing with malicious links to stuff like HTAs. Always panic when you see HTAs, and do good phishing and watering hole detection.
Cobalt Strike can be memory-resident only when injected into a process. A novice may create a new process which will look quite anomalous in EDR, and can be killed. A more experienced person will rapidly migrate into a system process you can't kill. But it won't survive shutdown.
Volatility and EDR are solid bets to detect injected processes. But did you know there are several public PowerShell scripts which can find and carve injected process space, effectively killing Cobalt Strike? Not a promising tool for real life, but a fun, fun, fun one for games.
Cobalt Strike can, of course, establish persistence. Yes, there are a billion ways to do this, but a really simple easy button to click is just making a new auto-starting service. Always check your service creation and abnormalities. Sysmon is your friend. Use @SwiftOnSecurity's
Cobalt Strike can also abuse temporary services just to start itself up in a privileged process. Always be on the lookout for high entropy and unknown services starting then vanishing. It may also drop, then promptly delete high entropy executables.
Once credentials have been stolen from a system (or if there's credential reuse) an adversary can use Cobalt Strike to move laterally to one system to another without establishing internet beacons directly to it. Sneaky! It uses the first system as a relay.
That's not the worst case ever, because the default methods to do this tend to be familiar stuff like WMI or PS abuse. Cobalt Strike may also establish named pipes between systems. It has four default names. You can look at named pipes with many tools like OSQuery and PowerShell.
So, a couple places you can catch that lateral movement - at the host, and at the network. Unencrypted exfil of Stuff Cobalt Strike Encourages Stealing is also quite visible at the network. For instance, credential dumps. Look for contents and sizes.
So a summary:
- The creator of Cobalt Strike is a good dude!
- It seriously sucks it's been stolen and repurposed
- It's a cool framework!
- It's a huge sandbox and nobody can claim to detect every configuration,
- Some defaults and behaviors, you can catch.
- Coverage across the kill chain, host and network, is really important in catching more sophisticated attacks like this
- If you catch one small component of Cobalt Strike, like lateral movement or an injected process, or beacons using it's default profiles, pull the thread.
- PowerShell and Sysmon are underrated host analysis tools, even if you don't have the most advanced EDR deployed widely. They take care and feeding.
- PowerShell is just as powerful for adversaries. Log PowerShell. Everyone freaking abuses it.
- Network monitoring is a must.
- Consider dedicated threat hunt hypotheses for Cobalt Strike TTPs in your environment. It's not just a cheaty way to catch the red team anymore. It's really being abused by a lot of bad guys, often times very clumsily.
I first started using Cobalt Strike in 2015, and it has been incredible to see its capabilities and the libraries of Aggressor Scripts and C2 Profiles for it grow. If you have the opportunity to get hands on with it I highly recommend it. It can be tough and $$$ to get a license.
However, it is really invaluable as a defender to understand at some level how it works and how to manipulate it - and what the default "easy button" options are.

• • •

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with Lesley Carhart

Lesley Carhart Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @hacks4pancakes

31 Jul
Lot of people asking how to gain forensics skills right off the street now. I got myself into this 🤷🏻‍♀️🍸. Best way to start to learn forensics is to *do it on your own Windows computer* (preferably physical). Start with basic sysinternals tools. @markrussinovich’s books are great.
You have a handy piece of evidence to examine right in front of you, and understanding how your own activity appears in memory, registry, caches, and MFT can often be much more memorable and educational than some VM lab. Lots of great free Windows forensics tools out there.
The tools we use day to day to do memory forensics are widely free, like Volatility. Disk forensics is still kind of controlled by a few expensive software powerhouses, but just learning how your own computer stores, processes, executes is a huge educational leap forward.
Read 4 tweets
31 Jul
Hey, so I want to talk about something that riles up or disheartens a lot of jr cybersecurity people and raises questions about gatekeeping, my perspective, and why I don't think it's as catastrophic as it looks from the outside. It has to do with experience required to do IR.
There is this unwritten set of rules that are constantly bandied about by senior DFIR people, and they go something like this:

"To do IR, you need 1-2 years of experience in cybersecurity (usually SOC)"


"To lead IR engagements you need 1-2 years of experience in DFIR"
OK, so is this gatekeepy? If you make it a static part of your hiring process, probably. Is it a bad guideline? No, and that's not so bad.

Let's talk about what Digital Forensics and Incident Response (DFIR) entails.
Read 18 tweets
29 Jul
Oh shoot. Madoka Magica is on Netflix. Time to warp some minds.
You're all like WAT, A WEEB SHOW?
Fine, go watch it. It's just some magical girls fighting evil, nbd
*without your children present.
Read 4 tweets
17 Jul
I love @SouthwestAir *tons*, but flying into O’Hare instead of Midway is an awful experience. One baggage carousel for all flights in the crowded international arrivals, and not even anywhere to get a bottle of water while waiting after McDonalds closes. Midway is so much nicer…
Terminal 5 rideshare pickup is free for all chaos, too 😢😑
I don’t get people who bash Midway. It’s a really nice and manageable airport since the refurb. Great food, too.
Read 4 tweets
3 Jul
We all kept telling them it was escalating and just going to get worse…
But no… every time one cybercrime group posts a mea culpa, or a few people get indicted or arrested, the pundits are like
Read 11 tweets
11 May
One of the most talented young martial artists I’ve ever worked with burnt out and suddenly quit after a decade today. I’m reeling.

I don’t know if any teens at all read my account at all but like... if there are a bunch of adults really invested in mentoring you it’s... (1/x)
... totally okay to say you’re like, overwhelmed, need a break, you need to switch learning styles or speed, or just that you need more support.

Please don’t just give up and vanish because you don’t think you can meet our expectations, or because you think you messed up.
This goes for like your hobbies, infosec, hacking, whatever. Like, people who mentor can be self-centered jerks, but most of us really just want you to succeed - even if your measure of success changes over time! We are emotionally invested in you.
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!