Cobalt Strike

What Is Cobalt Strike

How Does Cobalt Strike Work

Phishing Email

How Did We Catch Cobalt Track

How Can I Protect My Organization against Cobalt Strike

Patching Event Points

Endpoint Protection

Introduction

Interacting With Beacon

Situational Awareness Using Built In Commands

Situational Awareness Using Execute Assembly

Enumeration of Internal Website

Kerberoasting

Privilege Escalation via Lateral Movement

Cobalt Strike is Stealthy

Finding Cobalt Strike Code Injection

Signature and Beacon Detection

Named Pipes in Memory (Live System)

Named Pipe Detection with Symon

DETECTING COBALT STRIKE DEFAULT MODULES VIA NAMED PIPE ANALYSIS

Cobal Strike PowerShell Capabilities

Enabling PowerShell Logging

Cobalt Strike localhost Artifacts

Generate Cobalt Stike Payload

Reverse Engineer Loader

Execute Loader to unpack Stager shellcode

Dump shellcode and identify with yara

Execute Stager shellcode

Unpack Beacon payload and run Endpoint scanner

Analyze endpoint scan identifies Cobalt Strike in memory

Dump Beacon and parse configuration

Client-side Reconnaissance Use the System Profiler to discover which client-side applications your target uses

Spear Phishing Turn a saved email message into a pixel perfect phishing attack

Client-side Vulnerabilities Use the System Profiler results to find client-side attack options

Website Clone Tool Use Cobalt Strike's website clone tool to hide an attack in a legitimate looking site

Post Exploitaiton Take screenshots, snap webcam pics, browse files, and log keystrokes

Network Reconnaissance Use your first access to scan and enumerate your client's network

Exploit Targets Quickly search hundreds of exploits and launch an attack at multiple targets

Pass the Hash Use captured password hashes to attack those pesky patched systems

Intro

Egressing the network

Assess and understand the defenses in your current target context

Cobalt Strike Features

Running the teamserver script in Kali Linux

Collaboration features

Best practices for using multiple team servers

Access Management Cell

Beacon logs

Conclusion

Basic Redirector Setup

Cobalt Strike Setup

Troubleshooting

Setup Redirectors

Install SOCAT

Run Socat with Screen

Test

Configure Socat

Test on Lab Targets

Test on Windows 10

Cobalt Strike Basics

Intro

What is Cobalt Strike?

Cobalt Strike Setup

Team Server

Beacon Comms

Malleable C2

Artifact Kit (And Others)

In Memory Execution

Loader

HIding in Memory

Arbitrary Shellcode

App Control Bypasses

Lateral Movement

Top Methods

How to Get Creds

Attack Infrastructure

Operational Security

Cloud Fronting

C2 Methods

Named Pipe

Built in Features

WTH is JA3

JA3 Calculation

Stop Focusing on The Tool

Intro

Create a virtual machine for testing

How to Spearfish with Cobalt Strike

Connecting directly to cloud providers

Creating a template

Populating the Spearfish dialog

The SMTP protocol

Spoofing the From header

Setup DKIM, SPF, and DMARC

Conclusion

SSH Pivoting

Interact with SSH session

PWD command

SOX Pivoting

Sudo

Cross-session pivoting

Generate pivot beacon executable

Upload pivot beacon to target

Link SSH Session to Target

Conclusion

Cobalt Strike Explained- What It Is and How to Detect It

Cobalt Strike was created by Raphael Mudge in 2012.

Cobalt Strike is a paid pentest product mainly used as a post-exploitation tool.

Fobalt Strike

One of Cobalt Strike's strengths is its high level of customizability.

There are three main ways to detect Cobalt Strike

Scan the internet looking for Cobalt Strike servers

Check for beacons regularly connecting back to the control panel

Check for known Cobalt Strike named pipes

Introduction

Checking for Updates

Malicious Lnk File

Initial Beacon + UAC Bypass

Password Dump with BOFNET

Scheduled Task Persistence

Introduction

Why have we written about this now?

What is XDR?

Staged Beacons

Querying Data

Beacon Constellations

Tracking with SSL Public Keys

Q&A: How easy is it to spot non-default configs?

Can you share the link for the ebook download?

Closing Remarks

Agenda

Using 3rd Parties that Scan the Internet

How do you coerce a Team Server?

Architecture of our Scanning Tool

Malleable Profiles