Tool
tool:cobalt_strike
Also: Cobalt Strike implant
Off-the-shelf security tool used by the attackers after changing tactics.
Off-the-shelf security tool used by the attackers after changing tactics.
“such as Metasploit and Cobalt Strike.”
Suite of hacker tools downloaded by an infected system and used as an implant communicating with Conti infrastructure.
“they were able to delete those tools and clean that system”
“which was a Cobalt Strike implant which was communicating to Conti’s C2”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | command and control server | Explicit | 135 |
| incoming | USES | Carbanak | Explicit | 35 |
| incoming | INVOLVES | The D.R. Incident | Explicit | 135 |
Carbanak USES Cobalt Strike
After Carbanak signatures became known, the attackers switched to the off-the-shelf tool Cobalt Strike.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“they started using off-the-shelf tools such as Metasploit and Cobalt Strike”
The D.R. Incident INVOLVES Cobalt Strike
A compromised system downloaded Cobalt Strike, and a later Cobalt Strike implant communicated with Conti's command-and-control infrastructure.
Explicit Confidence 99% · Jack Rhysider EP 135 Details
“a system did get infected and it reached out to the command and control server to download Cobalt Strike”
“they now downloaded or installed a second malware, which was a Cobalt Strike implant which was communicating to Conti’s C2”
Cobalt Strike USES command and control server
The Cobalt Strike implant communicated with Conti's command-and-control server.
Explicit Confidence 98% · Omar Avilez EP 135 Details
“a Cobalt Strike implant which was communicating to Conti’s C2”