Collaborate Disseminate
I founded Strategic Cyber LLC in 2012 to advocate a vision of threat-representative security testing. Over time, Cobalt Strike became the de facto commercial standard for red team operations and adversary simulations. I’ve long asked myself, how do I stay a good partner to my customers as their numbers grow and this field evolves? Today […] Continue reading Cobalt Strike joins Core Impact at HelpSystems, LLC
Cobalt Strike 4.0 is now available. This release improves Cobalt Strike’s distributed operations model, revises post-exploitation workflows to drop some historical baggage, and adds “Bring Your Own Weaponization” workflows for privilege escalation and lateral movement. A Vision for Red Team Server Consolidation Cobalt Strike’s model for distributed operations (2013!) is to stand up a new […] Continue reading Cobalt Strike 4.0 – Bring Your Own Weaponization
Cobalt Strike 3.14 finally delivered some of the process injection flexibility I’ve long wanted to see in the product. In this post, I’d like to write about my thoughts on process injection, and share a few details on how Cobalt Strike’s implementation(s) work. Along the way, I will share details about which methods you might […] Continue reading Cobalt Strike’s Process Injection: The Details
I’m sometimes asked: “Raphael, what does Strategic Cyber LLC do to control Cobalt Strike?” That’s the subject of this blog post. What is Cobalt Strike? The textbook answer is that Cobalt Strike is a platform for red team operations and adversary simulations. In the right hands, Cobalt Strike empowers security professionals and enables better security […] Continue reading That time a printer tried to get Cobalt Strike
Cobalt Strike 3.14 is now available. This release benefits the OPSEC of Beacon’s post-exploitation jobs. To take a screenshot, log keystrokes, dump credentials, or scan for targets: Beacon often spawns a temporary process, injects the capability into it, and receives results over a pipe. While Cobalt Strike has a lot of flexibility around launching temporary […] Continue reading Cobalt Strike 3.14 – Post-Ex Omakase Shimasu
From February 4, 2019 to February 15, 2019 Strategic Cyber LLC connected to several live Cobalt Strike team servers to download Beacon payloads, analyze them, and study the information within these payloads. We conducted the survey from a system that exists separate of this company’s logs and records. The survey results were available on the […] Continue reading Cobalt Strike Team Server Population Study
Cobalt Strike 3.13 is now available. This release adds a TCP Beacon, process argument spoofing, and extends the Obfuscate and Sleep capability to the SMB and TCP Beacons. TCP Beacon Cobalt Strike has long had the ability to pivot over named pipes. Cobalt Strike 3.13 expands this peer-to-peer pivoting model with the TCP Beacon. Now, […] Continue reading Cobalt Strike 3.13 – Why do we argue?
Cobalt Strike 3.12 is now available. This release adds an “obfuscate and sleep” in-memory evasion feature, gives operators [some] control over process injection, and introduces hooks to shape how Beacon launches PowerShell. Obfuscate and Sleep One method to find adversary presence in an environment is to sweep all running processes for common strings that indicate […] Continue reading Cobalt Strike 3.12 – Blink and you’ll miss it
Red Team infrastructure is a detail-heavy subject. Take the case of domain fronting through a CDN like CloudFront. You have to setup the CloudFront distribution, have a valid SSL configuration, and configure your profile properly. If any of these items is wrong, your C2 will not work. Many folks take “configure your profile properly” for […] Continue reading Broken Promises and Malleable C2 Profiles
Cobalt Strike’s process to inject shellcode, via PowerShell, does not work with the latest Windows 10 update (v1803). While it’s possible to work without this capability, a lot of CS automation uses PowerShell. I’ve pushed an out-of-band update to Cobalt Strike 3.11 with a fix for this issue. What happened? The PowerShell shellcode injection scripts […] Continue reading PowerShell Shellcode Injection on Win 10 (v1803)