mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
62 lines
3.0 KiB
YAML
62 lines
3.0 KiB
YAML
name: Cobalt Strike
|
|
id: bcfd17e8-5461-400a-80a2-3b7d1459220c
|
|
version: 1
|
|
date: '2021-02-16'
|
|
author: Michael Haag, Splunk
|
|
description: Cobalt Strike is threat emulation software. Red teams and penetration
|
|
testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature
|
|
security programs. Most recently, Cobalt Strike has become the choice tool by threat
|
|
groups due to its ease of use and extensibility.
|
|
narrative: 'This Analytic Story supports you to detect Tactics, Techniques and Procedures
|
|
(TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor
|
|
scripts, malleable C2 profiles, default attack packages, and much more. For endpoint
|
|
behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes,
|
|
and DLL function names. Many additional variables are provided for in memory operation
|
|
of the beacon implant. On the network, depending on the malleable C2 profile used,
|
|
it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt
|
|
Strike. Not every query may be specific to Cobalt Strike the tool, but the methodologies
|
|
and techniques used by it.\
|
|
|
|
Splunk Threat Research reviewed all publicly available instances of Malleabe C2
|
|
Profiles and generated a list of the most commonly used spawnto and pipenames.\
|
|
|
|
`Spawnto_x86` and `spawnto_x64` is the process that Cobalt Strike will spawn and
|
|
injects shellcode into.\
|
|
|
|
Pipename sets the named pipe name used in Cobalt Strikes Beacon SMB C2 traffic.\
|
|
|
|
With that, new detections were generated focused on these spawnto processes spawning
|
|
without command line arguments. Similar, the named pipes most commonly used by Cobalt
|
|
Strike added as a detection. In generating content for Cobalt Strike, the following
|
|
is considered:\
|
|
|
|
- Is it normal for spawnto_ value to have no command line arguments? No command
|
|
line arguments and a network connection?\
|
|
|
|
- What is the default, or normal, process lineage for spawnto_ value?\
|
|
|
|
- Does the spawnto_ value make network connections?\
|
|
|
|
- Is it normal for spawnto_ value to load jscript, vbscript, Amsi.dll, and clr.dll?\
|
|
|
|
While investigating a detection related to this Analytic Story, keep in mind the
|
|
parent process, process path, and any file modifications that may occur. Tuning
|
|
may need to occur to remove any false positives.'
|
|
references:
|
|
- https://www.cobaltstrike.com/
|
|
- https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/
|
|
- https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/
|
|
- https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html
|
|
- https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html
|
|
- https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence
|
|
- https://github.com/zer0yu/Awesome-CobaltStrike
|
|
tags:
|
|
analytic_story: Cobalt Strike
|
|
category:
|
|
- Adversary Tactics
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection
|