Cobalt Strike can use a number of known techniques to bypass Windows UAC.^[1][2]

Cobalt Strike can usesudo to run a command.^[2]

Cobalt Strike can steal access tokens from exiting processes.^[1][2]

Cobalt Strike can make tokens from known credentials.^[1]

Cobalt Strike can spawn processes with alternate PPIDs.^[3][2]

Cobalt Strike can determine if the user on an infected machine is in the admin or domain admin group.^[4]

Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS. All protocols use their standard assigned ports.^{[1][5][2][6][7]}

Cobalt Strike can conduct peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.^[1][5]

Cobalt Strike can use a custom command and control protocol that can be encapsulated in DNS. All protocols use their standard assigned ports.^[1][5][2]

Cobalt Strike can download a hosted "beacon" payload usingBITSAdmin.^[8][5][2]

Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.^[1][2]

Cobalt Strike can execute a payload on a remote host with PowerShell. This technique does not write any data to disk.^[1][4]Cobalt Strike can also usePowerSploit and other scripting frameworks to perform execution.^[9][3][5][2]

Cobalt Strike uses a command-line interface to interact with systems.^{[9][5][2][10]}

Cobalt Strike can use VBA to perform execution.^[9][3][5]

Cobalt Strike can use Python to perform execution.^[9][3][5][2]

TheCobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.^[5]

Cobalt Strike can install a new service.^[9]

Cobalt Strike can use Base64, URL-safe Base64, or NetBIOS encoding in its C2 traffic.^[2]

Cobalt Strike can collect data from a local system.^[9][2]

Cobalt Strike can leverage the HTTP protocol for C2 communication, while hiding the actual data in either an HTTP header, URI parameter, the transaction body, or appending it to the URI.^[2]

Cobalt Strike will break large data sets into smaller chunks for exfiltration.^[1]

Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions.^[5][2]

Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data.^[5]

Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.^[5]

Cobalt Strike can exploit Oracle Java vulnerabilities for execution, including CVE-2011-3544, CVE-2013-2465, CVE-2012-4681, and CVE-2013-2460.^[5][2]

Cobalt Strike can exploit vulnerabilities such as MS14-058.^[9][2]

Cobalt Strike can explore files on a compromised system.^[2]

Cobalt Strike can use spoof arguments in spawned processes that execute beacon commands.^[2]

Cobalt Strike has the ability to use Smart Applet attacks to disable the Java SecurityManager sandbox.^[5][2]

Cobalt Strike can timestomp any files or payloads placed on a target machine to help them blend in.^[1][2]

Cobalt Strike can deliver additional payloads to victim machines.^[5][2]

Cobalt Strike can track key presses with a keylogger module.^[1][11][2]

Cobalt Strike can modify Registry values withinHKEY_CURRENT_USER\Software\Microsoft\Office\\Excel\Security\AccessVBOM\ to enable the execution of additional code.^[5]

Cobalt Strike's Beacon payload is capable of running shell commands withoutcmd.exe and PowerShell commands withoutpowershell.exe^[1][5][2]

Cobalt Strike can perform port scans from an infected host.^[1][5][2]

Cobalt Strike can query shared drives on the local system.^[9]

Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications.^[5][2]

Cobalt Strike can hash functions to obfuscate calls to the Windows API and use a public/private key pair to encrypt Beacon session metadata.^[5][2]

Cobalt Strike includes a capability to modify the Beacon payload to eliminate known signatures or unpacking methods.^[1][2]

Cobalt Strike has the ability to use an Excel Workbook to execute additional code by enabling Office to trust macros and execute code without user permission.^[5]

Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes.^[2]

Cobalt Strike can recover hashed passwords.^[1]

Cobalt Strike can usenet localgroup to list local groups on a system.^[2]

Cobalt Strike can identify targets by querying account groups on a domain contoller.^[2]

Cobalt Strike's Beacon payload can collect information on process details.^[1][5][2]

Cobalt Strike can inject a variety of payloads into processes dynamically chosen by the adversary.^[1][2][12]

Cobalt Strike has the ability to load DLLs via reflective injection.^[5][2]

Cobalt Strike can use process hollowing for execution.^[9][2]

Cobalt Strike uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.^[1][2]

Cobalt Strike can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access.^[1][2]

Cobalt Strike has the ability to accept a value for HTTP Host Header to enable domain fronting.^[2]

Cobalt Strike can queryHKEY_CURRENT_USER\Software\Microsoft\Office\\Excel\Security\AccessVBOM\ to determine if the security setting for restricting default programmatic access is enabled.^[5][2]

Cobalt Strike'sexecute-assembly command can run a .NET executable within the memory of a sacrificial process by loading the CLR.^[2]

Cobalt Strike can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.^[1][13]

Cobalt Strike can use Window admin shares (C$ and ADMIN$) for lateral movement.^[9][10]

Cobalt Strike can deliver Beacon payloads for lateral movement by leveraging remote COM execution.^[14]

Cobalt Strike can SSH to a remote service.^[9][2]

Cobalt Strike can useWinRM to execute a payload on a remote host.^[1][2]

Cobalt Strike uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.^[1][5][2]

Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval.^[1]

Cobalt Strike's Beacon payload is capable of capturing screenshots.^[1][11][2]

TheCobalt Strike System Profiler can discover applications through the browser and identify the version of Java the target has.^[2]

Cobalt Strike can use self signed Java applets to execute signed applet attacks.^[5][2]

Cobalt Strike can userundll32.exe to load DLL from the command line.^[2][12][10]

Cobalt Strike can determine the NetBios name and the IP addresses of targets machines including domain controllers.^[4][2]

Cobalt Strike can produce a sessions report from compromised hosts.^[5]

Cobalt Strike can enumerate services on compromised hosts.^[2]

Cobalt Strike can usePsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services.^[1][9][2]

Cobalt Strike can perform pass the hash.^[9]

Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.^[1][3][2]

Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.^[1][3]

Cobalt Strike can use WMI to deliver a payload to a remote host.^[1][2][12]

Storm-0501 has utilizedCobalt Strike for C2 communications and used a unique "license_id" of "666."^[15]

Storm-1811 operations include the use ofCobalt Strike.^[16][17]

^{[18][19][20][21][22][23][24]}

^[25]

^{[26][27][28][29][30][11][31]}

^[7]

^[32]

^[33]

^[34]

^[35]

^[36][37]

^[38]

^[39]

^[40][41][42]

^[43]

^{[44][45][46][47]}

^[6]

^[48]

^{[49][50][51][52][53][54][55][56]}

Sandworm Team has used multiple publicly available tools during operations, such as Cobalt Strike.^[57]

BlackByte has usedCobalt Strike as a post-exploitation tool.^[58][59]

^[60][61][62]

^{[63][64][65][66][67][68][69][70][71][72][73]}

^[43][74]

^[75]

^[76][77]

^[78][79]

^[80][43][81]

^{[82][83][84][85][86][87][88][89]}

Cobalt Strike was used duringAPT41 DUST.^[46]

^[12]

DuringC0017,APT41 used the DUSTPAN in-memory dropper to drop aCobalt Strike BEACON backdoor onto a compromised network.^[47]

^[90]

^[91][92]

^[63][64]