Cobalt Strike is a commercial red-team platform - and cracked versions are a favorite of real attackers and ransomware crews. Knowing its fingerprints is high-value.
Network tells
- Beaconing - regular callbacks with jitter (see the C2 beacon guide). Its default profiles have recognizable timing.
- JA3/JA3S TLS fingerprints - default and many custom profiles have known TLS client/server signatures.
- Malleable C2 URIs / headers - default profiles use recognizable paths and User-Agents unless the operator customizes them.
- DNS beaconing mode for stealth.
Host tells
- Named pipes - beacons use named pipes for peer-to-peer C2 with predictable naming patterns (
\\.\pipe\msagent_*,postex_*). - Process injection + spawnto - beacon injects into a sacrificial process (often
rundll32.exe/dllhost.exe) - look for injected threads and odd child processes. - Memory artifacts - unbacked executable memory (findable with memory forensics /
malfind).
Hunt it
Correlate: a process with no window making periodic, jittered TLS to one host, matching a known JA3, spawning rundll32 and using odd named pipes. Any one is weak; together they're Cobalt Strike. Public repos of JA3 hashes, named-pipe names and Malleable profile IOCs make great detection sources.