It is also intended for defenders to understand how Cobalt Strike works to create more robust detections. Additionally, Cobalt Strike is a great learning tool, which can be leveraged by newcomers to get hands-on experience with a C2 framework through red team training courses.Īs we continue to expand our C2 capabilities, we are sharing some insight into how we have built on the Cobalt Strike framework in the past, specifically by developing custom reflective loaders. For red teams willing to put in the research and development effort, they may still find operational success with Cobalt Strike while simulating these adversaries. However, there are still a large amount of threat actors leveraging pirated copies of Cobalt Strike, and it remains important to be able to simulate these threat actors.

Continuing to invest in expanding the capabilities and stealth of alternate 3rd party C2 frameworks.

Through research and development efforts, we have found better operational success in advanced red team exercises with: In the last two years, given over-signaturing of Cobalt Strike, we restrict its use to simulating less sophisticated threat actors, and instead leverage other 3rd party and in-house C2 when performing more advanced red team exercises. Some of our Cobalt Strike specific internal tools have public versions, such as “ InlineExecute-Assembly”, “ CredBandit”, and “ BokuLoader”. To continue Cobalt Strikes operational usage in the past, we on the IBM X-Force Red Adversary Simulation team invested significant research and development efforts to customize Cobalt Strike with internal tooling. Cobalt Strike being a popular red team Command and Control (C2) framework used by both threat actors and red teams since its debut, continues to be heavily signatured by security solutions. While next-generation AI and machine-learning components of security solutions continue to enhance behavioral-based detection capabilities, at their core many still rely on signature-based detections. The Challenge with Using Cobalt Strike for Advanced Red Team Exercises

Windows 8 loader