Intezer revealed that because Cobalt Strike's payloads are "usually shellcode encrypted with a rolling XOR key," static analysis and hash detection is much harder. Another term used to describe Cobalt Strike's payloads is "fileless code."
However, Intezer thinks it can be detected by combining multiple approaches. "The best way to detect Cobalt Strike code is through a combination of dynamic, static, and genetic analysis," the company's blog says, noting the importance of in-memory code scans. Read more.