Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
Cobalt Strike is a publicly available and well known tool associated with pen testing, security assessments, and persistent, planned attacks. Inbound connections from Cobalt Strike servers might indicate attempts to discover vulnerabilities and install Cobalt Strike Beacon, which enables command-and-control (C&C) activity.
Kill Chain
Risk Score
60
Cobalt Strike is an attack toolkit that is often associated with malicious activity. Attackers install the Cobalt Strike Beacon payload on a compromised device and the beacon initiates a connection to a C&C server, referred to as the Cobalt Strike team server. Cobalt Strike team servers are designed to receive communications from a compromised device but do not usually initiate connections. A connection from a known Cobalt Strike server might mean an attacker is repurposing the server to conduct reconnaissance or other malicious activity.
Block inbound and outbound traffic from suspicious IP addresses at the network perimeter
Quarantine the device while checking for the presence of malware
