Skip to content
Hermes Codex

Threat Profile: Cobalt Strike & C2 Infrastructure Hunting

1. Architectural Components

Section titled “1. Architectural Components”

Understanding Cobalt Strike requires dissecting its three-tier architecture. Threat actors use this structure to abstract their actual location and maintain persistent access to compromised networks.

1. The Team Server

The central C2 hub, deployed by the attacker on a VPS or bulletproof hosting provider. It manages beacon callbacks, hosts the Malleable C2 profiles, coordinates lateral movement, and logs all extracted data.

2. The Client

The graphical user interface utilized by the threat actor to connect to the Team Server. It provides the operator with a real-time visual map of the compromised network.

3. The Beacon (Payload)

The actual implant deployed on the victim’s machine. It is a highly sophisticated, asynchronous agent that polls the Team Server for tasks, executes them entirely in memory, and returns the results.

2. Beacon Superpowers & Evasion TTPs

Section titled “2. Beacon Superpowers & Evasion TTPs”

The Beacon is much more than a standard reverse shell; it is a full-fledged post-exploitation Swiss Army knife designed to defeat static endpoint protection.

A. Malleable C2 (Network Evasion)

Section titled “A. Malleable C2 (Network Evasion)”

This is Cobalt Strike’s most formidable feature. Malleable C2 profiles allow the operator to completely rewrite the beacon’s network signature. An attacker can alter HTTP headers, URIs, User-Agents, and payload encoding to make their C2 traffic look exactly like Google Analytics, jQuery, or Microsoft Update telemetry. This renders traditional, signature-based IDS/IPS appliances almost useless.

B. In-Memory Execution and Process Injection

Section titled “B. In-Memory Execution and Process Injection”

Cobalt Strike aims to operate completely fileless after the initial execution. It relies heavily on Reflective DLL Injection and Process Hollowing. The beacon typically injects its payload into legitimate Windows processes (like svchost.exe, rundll32.exe, or werfault.exe). Consequently, the malicious code runs inside a trusted, signed Microsoft binary memory space, bypassing legacy antivirus engines.

C. Post-Exploitation Arsenal

Section titled “C. Post-Exploitation Arsenal”

The Beacon includes built-in capabilities to execute Living Off The Land (LOLBAS) techniques natively:

  • Credential Dumping: In-memory execution of Mimikatz to extract clear-text passwords and NTLM hashes from the LSASS process.
  • Token Manipulation: Executing Pass-the-Hash (PtH) and Pass-the-Ticket (PtT) attacks directly from memory.

D. Lateral Movement via SMB Beacons

Section titled “D. Lateral Movement via SMB Beacons”

If an endpoint cannot reach the internet (e.g., an isolated database server), an attacker can deploy an SMB Beacon. This beacon communicates with a primary, internet-facing beacon over the internal network usingNamed Pipes encapsulated in SMB. To network defenders, this traffic appears as standard internal Windows file sharing, keeping the deep network intrusion completely dark.

3. Endpoint DFIR & Process Lineage

Section titled “3. Endpoint DFIR & Process Lineage”

Detecting Cobalt Strike on an endpoint requires behavioral analysis and memory forensics.

  • Process Lineage Anomalies: As highlighted by Elastic Security research, default Cobalt Strike behavior often involves spawning rundll32.exe without any command-line arguments to host the injected beacon. A rundll32.exe process with an empty command line or spawned by an unexpected parent (like winword.exe or wscript.exe) is a massive red flag. (Correlate with Event 4688).
  • Sysmon Event ID 8 (CreateRemoteThread): Monitor for processes injecting threads into svchost.exe or lsass.exe.
  • Memory Forensics & Config Extraction: If an analyst captures a memory dump of an infected machine, tools like Volatility or specific scripts (e.g., Didier Stevens’ 1768.py) can carve the memory to locate the Beacon. Extracting the Beacon Configuration Block is the ultimate jackpot: it reveals the attacker’s Malleable C2 profile, sleep times, Named Pipe strings, and exact Team Server IP/Domains.

4. Proactive Threat Hunting: Finding Team Servers

Section titled “4. Proactive Threat Hunting: Finding Team Servers”

Cyber Threat Intelligence (CTI) analysts do not just wait for alerts; they actively scan the IPv4 space to identify and block Cobalt Strike infrastructure before an attack occurs. According to advanced hunting methodologies by Hunt.io, Team Servers can be uncovered via distinct OPSEC failures by the attackers.

  1. Default Ports: The default port for the Team Server management interface is 50050. Scanning for this exposed port is the first step in identifying amateur adversary infrastructure.
  2. JARM Fingerprinting: JARM is an active TLS server fingerprinting tool. Out-of-the-box Cobalt Strike Team Servers often return a highly specific JARM hash (e.g., 07d14d16d21d21d00042d41d00041d...).
  3. HTTP Response Anomalies: Default Team Servers respond to unauthenticated web requests with a 404 Not Found error featuring an exact Content-Length: 0 and specific Date header formatting.
  4. Open Directories: Attackers frequently misconfigure their payload hosting directories. CTI platforms index open directories containing typical payload names like payload.bin, beacon.exe, or default PowerShell stagers.

5. Detection Rules

Section titled “5. Detection Rules”
hunt_cs_rundll32_injection.kql
// Detects suspicious rundll32 execution often associated with Cobalt Strike process injection
DeviceProcessEvents
| where FileName =~ "rundll32.exe"
// Cobalt Strike frequently spawns rundll32 without arguments to inject the beacon payload
| where isempty(ProcessCommandLine) or ProcessCommandLine endswith "rundll32.exe"
// Exclude normal parent processes to reduce noise
| where InitiatingProcessFileName !in~ ("explorer.exe", "svchost.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine

Sources & References

Section titled “Sources & References”