threat-intel
Hunting Cobalt Strike: Beacons, Named Pipes, and Malleable Profiles
Info
Summary
Cobalt Strike is a popular post-exploitation framework heavily used by ransomware affiliates, access brokers, and state-aligned groups. A layered approach – examining network traffic, certificates, pipe creation, and memory – is crucial for confirming Beacon activity. The article emphasizes the importance of capturing memory images and correlating findings across multiple planes to effectively identify and contain Beacon campaigns.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data