Live Cybersecurity Webinar — Deconstructing Cobalt Strike

Organizations’ cybersecurity capabilities have improved over the
past decade, mostly out of necessity. As their defenses get better,
so do the methods, tactics, and techniques malicious actors devise
to penetrate their environments.

Instead of the standard virus or trojan, attackers today will
deploy a variety of tools and methods to infiltrate an
organization’s environment and attack it from the inside.

In an interesting twist of fate, one of the tools organizations
have used to audit and improve their defenses has also become a
popular tool attackers use to infiltrate. Cobalt Strike is an
Adversary Simulation and Red Team Operations tool that allows
organizations to simulate advanced attacks and test their security
stacks in a close-to-real-world simulation.

A new research webinar from XDR provider Cynet (register here^[1]) offers a better look at
Cobalt Strike. The webinar, led by Cyber Operations Analyst for the
Cynet MDR Team Yuval Fischer, will take a deep dive into the
threat.

As a simulation, it is impressive in its capabilities, and it’s
prized for being highly customizable. All these traits have also
made it an effective attack tool for actual malicious actors.
Cobalt Strike is a C2 server that offers highly sophisticated and
easy-to-use features, and the past year has seen a huge jump in the
number of recorded Cobalt Strike attacks in the wild. In fact, a
study by Recorded Future’s Insikt Group found that Cobalt Strike
was the most commonly deployed C2 server in malicious attacks.

One of the biggest reasons Cobalt Strike has become so
widespread is its various capabilities, which include:

• Reconnaissance on client-side software usage, as well as
  version vulnerabilities
• A variety of attack packages that include social engineering,
  trojans, and masquerading tools
• Collaboration tools that let group host share data with a group
  of attackers
• Post exploitation tools to deploy scripts, log keystrokes and
  execute other payloads
• Covert communication tools that let teams modify network
  indicators on the go
• Browser pivoting to circumvent

Additionally, Cobalt Strike uses Beacon, a powerful delivery
mechanism that can be transmitted over various protocols, and hide
by modifying its network signature, emulating other types of
malware, and even masquerading as legitimate traffic.

Even so, Cobalt Strike is not undetectable. However, it requires
a variety of techniques to detect it properly. This includes things
like examining default TLS certificates, searching for open ports,
And performing HTTP requests to find non-existent pages. Even then,
most organizations require advanced tools actually to defend
against Cobalt Strike..

The new research webinar dives deeper into Cobalt Strike. It
does so by exploring a few areas:

• The basics of Cobalt Strike as an attack tool.
  This includes breaking down how it works, what makes it so
  effective, and how malicious actors have modified, customized, and
  upgraded it to become more dangerous.
• Instances in the wild. More than any
  theoretical research, live case studies provide the greatest
  insights into how Cobalt Strike operates and succeeds in
  penetrating organizations’ defenses.
• A deeper dive into Cobalt Strike’s capabilities and
  deployment tools. The webinar will also dive deeper into
  Cobalt Strike’s different functionalities, how they’re deployed,
  and what they actually do.
• How organizations can defend against Cobalt
  Strike. Finally, the webinar will touch on the ways
  organizations can detect and defend against Cobalt Strike, and how
  they can mitigate the impact of a successful initial
  infiltration.

You can register here for the webinar^[2].