Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
Cobalt Strike is an attack toolkit that enables an attacker to set up a sophisticated command-and-control (C&C) infrastructure. Through a persistent connection, an attacker can remotely control a device and gain an entry point for further attacks on your network.
Kill Chain
Risk Score
92
Cobalt Strike enables post-compromise activity with Beacon agents. After a successful exploit, attackers install the Cobalt Strike Beacon payload on a device in your environment where the beacon initiates a connection to a C&C server, referred to as the Cobalt Strike team server. A Cobalt Strike Beacon executable in your environment indicates that an attacker might have compromised a device on your network. Monitor your environment for compromised devices exhibiting unusual behavior, such as outbound connections to new external endpoints.
