Cobalt Strike

Detecting malicious Cobalt Strike activity

Created in 2012 by Raphael Mudge, Cobalt Strike is a remote access tool developed for ethical hackers to enable threat simulation security tests. However, Cobalt Strike is now a command and control (C2) framework used by both the security community and malicious threat actors.

Cobalt Strike is built in a way that enables threat actors to conduct spear phishing attacks and gain unauthorized access to systems to deliver malware. This malware is used to install a malicious payload called the Cobalt Strike Beacon, which supports attack tactics like lateral movement across a variety of protocols as well as many C2 functions.

This video talks about what Cobalt Strike is, how attackers use the Cobalt Strike Beacon to achieve lateral movement, and how you can defend your organization against such malicious activity. Watch the video to learn more—three minutes is all it takes!