Cobalt Strike
Roselee Pando
The cobaltstrike/logs/ directory includes a directory structure of the format [date]/[internal ip of beaconed host]/[beacon id].log. Each file is a plaintext log of every beacon command and the associated output. This mirrors what an operator would see in the Cobalt Strike beacon console.
The cobaltstrike/screenshots/ and cobaltstrike/downloads/ folders each respectively contain all screenshots or files an operator has downloaded from beacons.
Files hosted on a team server and served through the Web feature of Cobalt Strike are saved in the cobaltstrike/uploads/ directory. An individual operator/client working directory, will only contain files which that operator uploaded.
The cobaltstrike/data directory includes several .bin files which are serialized Java objects of different data models used by Cobalt Strike to track its state. The data from Cobalt Strike serialized .bin logs can be extracted as CSVs using this script.
A matching public key means that two payloads came from a team server(s) using the same .cobaltstrike.beacon_keys keystore. This does NOT NECESSARILY mean it came from the same team server. Again, someone could copy the whole Cobalt Strike directory, including the keystore, as is sometimes done with distributed or cracked copies.
While Cobalt Strike is primarily used by security professionals to assess the security of networks and systems, it is also used by cybercriminals for malicious purposes. For several reasons, cobalt Strike has also become a favorite tool of black hackers. Some of the key reasons include its power and versatility and its ability to remotely control and monitor attacks and generate detailed reports on their activities.
The researchers also explore the use of Cobalt Strike by threat actors distributing the Qbot/Qakbot banking Trojan, of which one of the plugins -- plugin_cobalt_power3 -- enables the pen testing tool.
Does Crowdstrike offers any Cobalt Strike beacon detection mechanism. I was referring to the post, doesn't seem to include much on detection part but rely on SIEM and other monitoring solutions. I can speak from experience point with other EDR solutions, it does get captured in telemetry but what does CS offers from Cobalt strike detection front?
My reference link: -the-bacon-from-cobalt-strike-beacon/
As a FYI, a Chinese forum member over at malwaretips.com performed a test against a whole bunch of security solutions using 10 custom coded Cobalt Strike payloads: -vs-cobaltstrike.121263/#post-1026903 .
I find interesting reading via Opens a new window - in the past month they have had 4 or more 'pulses' all to do with Cobalt Strike, you might like to take a browse. For instance: cobalt strike indicators q3 2021 Opens a new window or IcedID and Cobalt Strike vs Antivirus Opens a new window. The 'reference' links have interesting reads.
Cobalt strike is a red team command and control framework used for adversary emulation. Due to its functionality and flexibility, it has been widely adopted by both red teams and threat actors. Multiple threat actors such as APT29, APT32, APT 41, APT19, UNC2452, FIN6 use cracked versions of Cobalt Strike in their attacks.
df19127ead