Showing Articles About
cobalt strike
-
Riccardo Ancarani - 9 Apr 2021
Detecting Exposed Cobalt Strike DNS Redirectors
A technique was developed to detect exposed Cobalt Strike DNS redirectors by identifying DNS servers that consistently return the same IP address for all domain queries. The method involves scanning DNS servers and analyzing their response patterns to identify potential Cobalt Strike infrastructure. An internet-wide survey was conducted to validate the detection approach, revealing multiple potential Cobalt Strike DNS servers.
- Riccardo Ancarani
- 20 Nov 2020
Detecting Cobalt Strike Default Modules via Named Pipe Analysis
A technical analysis of Cobalt Strike's default modules reveals distinctive named and anonymous pipe communication patterns. The article explores how Cobalt Strike uses pipes for inter-process communication during post-exploitation activities like keylogging and screenshot capture. Detection techniques are proposed, including Yara rules and Splunk searches to identify these unique pipe characteristics.
- Riccardo Ancarani
- 24 Jun 2020
Attack Detection Fundamentals: Initial Access - Lab #3
This article details a multi-stage initial access attack technique used by the Cobalt Kitty group involving a malicious Word macro. The attack creates a scheduled task to execute an obfuscated PowerShell payload that ultimately injects a Cobalt Strike beacon into memory. The walkthrough explores detailed steps of crafting a beacon delivery mechanism while highlighting potential detection strategies.
-
William Burgess - 18 Jul 2018
Bypassing Memory Scanners with Cobalt Strike and Gargoyle
A novel technique for bypassing memory scanners using the Gargoyle method with Cobalt Strike is demonstrated. The approach involves periodically staging and removing a beacon payload from memory to evade detection by endpoint security solutions. By moving in and out of executable memory at timed intervals, the technique aims to avoid traditional memory scanning techniques.
- William Knowles
- 22 Sep 2017
"Tasking" Office 365 for Cobalt Strike C2
A novel Command and Control (C2) technique for Cobalt Strike was demonstrated using Office 365's Exchange Web Services. The technique leverages Outlook tasks as a communication channel to transmit malicious traffic through a legitimate service. The proof-of-concept shows how attackers can use the External C2 interface to create covert communication paths through enterprise collaboration tools.