Cobalt Strike is a legitimate red team product, but cracked and leaked copies have been the post-exploitation framework of choice for ransomware affiliates and state groups for a decade, so a Beacon in your network is usually the last warning before encryption or data theft. This guide treats Cobalt Strike as a threat profile: who abuses it, what it does in ATT&CK terms, why it is an identity problem as much as a malware problem, and how defenders find it on endpoints and on the wire. It is for SOC analysts, detection engineers, responders and identity teams, and is defensive only. For command and control in general, see the Command and Control (C2) Guide; this page goes deeper on one framework.
Key takeaways
- Authorised and abused copies look alike. The same software runs your red team exercise and a ransomware affiliate's intrusion, so detection has to be paired with an authorisation register and version context.
- It touches almost the whole ATT&CK matrix. MITRE ATT&CK v20 maps Cobalt Strike (S0154) to 73 techniques and lists 36 groups and campaigns that use it, from APT29 and APT41 to Wizard Spider, Play and Storm-1811.
- Takedowns cut supply but did not end use. Operation Morpheus took down 593 of 690 flagged servers in June 2024, and Fortra reported in March 2025 an 80% fall in unauthorised copies over two years; the remaining copies still matter.
- Beacon is a credential harvester. LSASS dumping, token theft, pass the hash and service creation over admin shares turn one foothold into domain-wide access, so local admin and service account hygiene limit the blast radius.
- Behaviour beats signatures. Version-specific YARA rules catch old cracked builds, but durable detection comes from process injection, named pipe, service install and beaconing patterns correlated across endpoint and network data.
Who they are (names and aliases)
Cobalt Strike is a commercial product, developed in 2012 and acquired by Fortra in 2020. ATT&CK v20 describes it as a full-featured remote access tool that bills itself as adversary simulation software, whose post-exploitation capabilities cover the full range of ATT&CK tactics, and which also leverages Metasploit and Mimikatz (S0002). The threat is the stolen, leaked and cracked older versions circulating in criminal markets. Fortra's July 2024 statement on Operation Morpheus says criminals have stolen older versions to create cracked copies, and that unlicensed versions were linked to investigations into Ryuk, Trickbot and Conti.
| Name or component | What it is | Why defenders care |
|---|---|---|
| Cobalt Strike (ATT&CK S0154) | Commercial adversary simulation framework; the server component is called the team server | Single integrated toolkit for C2, lateral movement and credential theft |
| Beacon | The implant (payload) that runs on compromised hosts and checks in to the team server | The artefact you detect in memory, on disk and in network traffic |
| Cracked or leaked builds | Older versions with licence checks removed | Lag the current release, which is what version-specific YARA rules exploit |
| Authorised red team use | Licensed copies used under rules of engagement | Must be registered so the SOC can tell an exercise from an intrusion |
Targeting and motivation
Cobalt Strike has no motivation of its own: it inherits the goals of whoever runs it. ATT&CK v20 lists both espionage groups (APT19, APT29, APT32, APT37, APT41, Mustang Panda, menuPass, Sandworm Team, and the SolarWinds Compromise campaign) and financially motivated actors (FIN6, FIN7, TA505, Cobalt Group, Wizard Spider, Indrik Spider, BlackByte, Play, Storm-0501 and Storm-1811). Reporting by The Record on Fortra's March 2025 update notes that Microsoft observed nation-state groups from Russia, China, Vietnam and Iran using cracked copies, and that Cobalt Strike featured in dozens of ransomware attacks on healthcare institutions and in the 2022 ransomware attack on the government of Costa Rica.
- Ransomware affiliates: CISA's #StopRansomware advisory on Play (AA23-352A) states that Play actors use Cobalt Strike and SystemBC for command and control, PsExec for lateral movement and Mimikatz to obtain domain administrator access. See the Play Ransomware Profile and the Ransomware-as-a-Service Business Model Guide.
- Access brokers and loaders: Beacon is frequently the second stage after a commodity loader or a sold foothold. See the Initial Access Brokers Guide.
- Help desk and vishing crews: ATT&CK lists Storm-1811, which pairs email bombing with fake IT support calls, among Cobalt Strike users. See the Storm-1811 Threat Actor Profile Guide.
- State espionage: APT29 and others used it in long-running intrusions. See the APT29 (Midnight Blizzard) Threat Actor Profile.
Tactics and techniques (MITRE ATT&CK)
The table selects the ATT&CK v20 techniques mapped to S0154 with the best detection opportunities. Note the v20 tactic changes: process injection now sits under Stealth and Privilege Escalation, and the Smart Applet behaviour that disables Java security is mapped to T1685 Disable or Modify Tools under Defense Impairment (TA0112).
| Tactic | Technique (ID) | How Beacon uses it (per ATT&CK) | Primary telemetry |
|---|---|---|---|
| Command and control | Web Protocols (T1071.001), DNS (T1071.004) | Custom C2 protocol carried over HTTP, HTTPS or DNS | Proxy logs, DNS logs, Sysmon 22, NDR |
| Command and control | File Transfer Protocols (T1071.002), Internal Proxy (T1090.001) | Peer-to-peer Beacons relay over SMB named pipes so only one host talks out | Sysmon 17 and 18, SMB east-west flows |
| Command and control | Domain Fronting (T1090.004), Scheduled Transfer (T1029) | Accepts a custom HTTP Host header; checks in on a set interval | TLS SNI versus Host mismatch, periodicity analysis |
| Stealth, privilege escalation | Process Injection (T1055), Process Hollowing (T1055.012), Reflective Code Loading (T1620) | Injects payloads into other processes; runs .NET assemblies in memory | Sysmon 8, 10 and 25, EDR memory scans |
| Stealth, privilege escalation | Token Impersonation/Theft (T1134.001), Make and Impersonate Token (T1134.003), Parent PID Spoofing (T1134.004) | Steals or creates tokens; spawns processes with a false parent | 4624 logon type 9, 4648, process lineage anomalies |
| Credential access | LSASS Memory (T1003.001), Security Account Manager (T1003.002) | Injects into LSASS to dump credentials; recovers password hashes | Sysmon 10 on lsass.exe, ASR LSASS rule events |
| Lateral movement | Pass the Hash (T1550.002), SMB/Windows Admin Shares (T1021.002), Windows Remote Management (T1021.006) | Uses hashes and admin shares C$ and ADMIN$ to reach remote hosts | 4624 logon type 3 with NTLM, 5140 share access |
| Execution, persistence | Service Execution (T1569.002), Windows Service (T1543.003), PowerShell (T1059.001), Windows Management Instrumentation (T1047) | Runs payloads remotely via PsExec-style services, PowerShell and WMI | System 7045, 4697, PowerShell 4104 |
How they abuse identities and credentials
Most of what makes a Beacon dangerous is identity abuse. ATT&CK records that Cobalt Strike can use known credentials to run commands as domain accounts (T1078.002) and local accounts (T1078.003), steal tokens from running processes and make new ones from captured passwords. In the Play advisory, CISA describes Mimikatz being used to reach domain administrator and to add accounts to domain controllers.
- Shared local administrator passwords: a hash captured on one workstation works on every machine with the same password, so pass the hash spreads in minutes. Unique, rotated passwords from Windows LAPS break this chain. See the Local Administrator Password Solution (LAPS) Guide.
- Privileged sessions on ordinary hosts: when a domain admin or a backup service account logs on interactively to a workstation, its credentials sit in LSASS for Beacon to dump. Tiered administration and privileged access workstations keep tier 0 credentials off tier 2 machines. See the Credential Dumping Guide.
- Service accounts with broad rights: service accounts running on many servers, with passwords that never change, are prime targets for token theft and Kerberoasting (T1558.003, a common companion technique, not one ATT&CK attributes to S0154 itself). Move to group managed service accounts. See the Group Managed Service Accounts (gMSA) Guide.
Credential reset is part of eviction: reset every account exposed on a Beacon host, including service accounts and krbtgt if domain controllers were reached. See the Pass-the-Hash and Pass-the-Ticket Guide.
Notable incidents and disruption
| Date | Event | What it showed |
|---|---|---|
| November 2022 | Google Cloud Threat Intelligence released open-source YARA rules and a VirusTotal collection covering Cobalt Strike versions 1.44 to 4.7 (34 releases, 275 unique JAR files) | Cracked copies usually lag at least one release, so version-specific signatures can target them while leaving the current licensed release alone |
| March 2023 | US District Court for the Eastern District of New York order allowing Microsoft, Fortra and Health-ISAC to pursue malicious infrastructure and notify ISPs and CERTs | Civil legal action can disrupt C2 infrastructure at scale |
| 24 to 28 June 2024 | Operation Morpheus, led by the UK National Crime Agency and coordinated by Europol: 690 IP addresses flagged to providers in 27 countries, 593 taken down; over 730 threat intelligence items with almost 1.2 million indicators shared | Coordinated action against unlicensed team servers; private partners included BAE Systems Digital Intelligence, Trellix, Spamhaus, abuse.ch and Shadowserver |
| March 2025 | Fortra reported an 80% reduction in unauthorised copies in the wild over about two years, over 200 malicious domains seized or sinkholed, and detection-to-takedown time under one week in the US | Supply has shrunk, but residual copies and replacement frameworks remain |
The lesson for defenders is that takedowns lower the volume of abuse without removing the need for detection. Affiliates move to other frameworks, but the behaviours in the ATT&CK table stay much the same, so behavioural detections carry over. See the Cybercrime Law Enforcement Takedowns Guide.
Detection and defence
Endpoint detections
| Signal | Source | What to look for | False positive notes |
|---|---|---|---|
| Remote thread into another process | Sysmon 8 (CreateRemoteThread) | Office, browser or script hosts creating threads in rundll32.exe, svchost.exe or explorer.exe | Some security and accessibility tools inject legitimately; baseline them |
| Handle opened on LSASS | Sysmon 10 (ProcessAccess), ASR rule 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 | Non-system processes requesting read access to lsass.exe | Microsoft notes the ASR LSASS rule is noisy in audit; tune before block |
| Named pipe creation | Sysmon 17 and 18 (PipeEvent) | Pipes created by rundll32.exe or injected processes, unusual pipe names, pipe connections between workstations | Build a baseline of normal pipe names per application |
| Remote service install | System 7045, Security 4697 | New services with random names or command lines that run PowerShell, rundll32 or binaries from ADMIN$ | Software deployment tools; allowlist by signer and path |
| Spawn-to and argument anomalies | Sysmon 1, Security 4688 with command line | rundll32.exe with no arguments, processes whose parent is unexpected (PPID spoofing) | Correlate with EDR true parent data where available |
| Known builds | YARA (Google GCTI rules) on memory and files | Matches for non-current Cobalt Strike versions | A match on an old version is a strong unlicensed signal |
Pair these with Microsoft Defender attack surface reduction rules where you run Defender: "Block process creations originating from PSExec and WMI commands" (d1e49aac-8f56-4280-b9ba-993a6d77406c) and "Block Office applications from injecting code into other processes" (75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84). See the Sysmon Guide and the YARA Rules Guide.
Network detections
- Beaconing: regular check-ins with jitter to a rare destination, low byte counts and long session lifetimes. Score periodicity per host and destination pair rather than alerting on single connections. MITRE D3FEND maps this to Connection Attempt Analysis (D3-CAA) and Network Traffic Community Deviation (D3-NTCD).
- DNS C2: high volumes of TXT or A record queries to one domain with encoded subdomains (D3FEND DNS Traffic Analysis, D3-DNSTA).
- TLS server fingerprints: Salesforce's JARM project found that an internet-wide port 443 scan matched many Cobalt Strike team servers, but the same fingerprint also matched Burp Collaborator and other legitimate servers. Use JARM or JA3/JA3S as enrichment, combined with server history, hosting provider and certificate authority, never as a block list on its own (D3FEND Certificate Analysis, D3-CA).
See the NDR Guide and the TLS Inspection Guide.
Rollout and response
- Register authorised use. Keep a register of every licensed red team engagement (dates, source IPs, team server domains, scope) and share it with the SOC before testing starts. See the Red Team Rules of Engagement Template.
- Collect the telemetry. Enable Sysmon events 1, 3, 8, 10, 17, 18, 22 and 25 with a tuned configuration, command line logging for 4688, PowerShell script block logging (4104) and DNS and proxy logs.
- Deploy in audit first. Run ASR rules and new SIEM detections in audit or alert-only mode for two to four weeks, tune exclusions, then move to block for pilot rings before estate-wide. Roll back by returning a rule to audit, not by disabling it.
- Validate with purple teaming. Have the red team run a licensed Beacon in a controlled window and confirm each detection fires. See the Purple Teaming Guide.
- Respond as a pre-ransomware incident. On a confirmed unauthorised Beacon: isolate the host, capture memory before reboot, identify the team server and all hosts talking to it or over its pipes, reset exposed credentials, then hunt for staged exfiltration and backup tampering.
Decision guidance
Smaller organisations with a managed EDR service should focus on three things: confirm the provider detects LSASS access, remote service creation and process injection; deploy Windows LAPS; and keep an authorised testing register. Larger estates should add network beaconing analytics, internal SMB monitoring and memory YARA scanning on high-value servers. Feed-based team server indicators are cheap to block but expire quickly.
Metrics
- Detection coverage: percentage of the ATT&CK techniques in the table above with a tested detection (target 80% or more).
- Purple team pass rate: share of emulated Beacon behaviours detected within 15 minutes.
- Mean time to contain: time from first Beacon alert to host isolation.
- Credential exposure: number of hosts where tier 0 accounts logged on interactively in the last 30 days (target zero).
- LAPS coverage: percentage of Windows endpoints with unique managed local administrator passwords.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01, DE.AE-02, RS.AN-03 | Network monitoring, analysis of adverse events, incident analysis |
| NIST SP 800-53 Rev. 5 | SI-4, AU-6, IR-4, SC-7, AC-6, CM-7 | System monitoring, log review, incident handling, boundary protection, least privilege, least functionality |
| CIS Controls v8.1 | 8 Audit Log Management, 10 Malware Defenses, 13 Network Monitoring and Defense | Telemetry, anti-malware and network detection |
| ISO/IEC 27001:2022 Annex A | A.8.7 Protection against malware, A.8.16 Monitoring activities | Control objectives for malware and monitoring |
| MITRE D3FEND | D3-PSA Process Spawn Analysis, D3-PLA Process Lineage Analysis, D3-CAA, D3-DNSTA | Defensive techniques for injection, lineage and beaconing |
Practitioner checklist
- Maintain an authorised red team register and share engagement indicators with the SOC before each test.
- Enable Sysmon 8, 10, 17, 18, 22 and 25 plus 4688 command line and 4104 script block logging on all Windows hosts.
- Deploy the ASR LSASS, PSExec and WMI, and Office injection rules in audit, tune, then block in rings.
- Scan memory and files on servers with version-specific Cobalt Strike YARA rules, and treat a non-current version match as unlicensed until proven otherwise.
- Run beaconing analytics on proxy and DNS logs, and alert on workstation-to-workstation SMB named pipe traffic.
- Deploy Windows LAPS and keep tier 0 credentials off workstations and member servers.
- Replace static service account passwords with gMSA, and include service accounts in post-incident credential resets.
- Run a purple team exercise with a licensed Beacon at least yearly and track the pass rate.
Standards and references
- MITRE ATT&CK: Cobalt Strike (S0154)
- CISA: #StopRansomware: Play Ransomware (AA23-352A)
- Fortra: Europol Coordinates Global Action Against Criminal Abuse of Cobalt Strike
- Google Cloud: Making Cobalt Strike harder for threat actors to abuse
- Microsoft Learn: Attack surface reduction rules reference
- Microsoft Learn: Sysmon
- Salesforce Engineering: Easily Identify Malicious Servers on the Internet with JARM
- The Record: Malicious use of Cobalt Strike down 80% after crackdown, Fortra says
Related NHI Mgmt Group resources: Command and Control (C2) Guide · Lateral Movement Guide · EDR Evasion and Defence Guide · Threat Hunting Guide · Ransomware Response and Recovery Guide