Procedure examples

Cobalt Strike can make tokens from known credentials.

Cobalt Strike can spawn processes with alternate PPIDs.

Cobalt Strike can query shared drives on the local system.

Cobalt Strike has the ability to use an Excel Workbook to execute additional code by enabling Office to trust macros and execute code without user permission.

Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions. The Cobalt Strike loader component can also decrypt the .bss section of the Beacon binary prior to execution.

Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.

Cobalt Strike can download a hosted "beacon" payload using BITSAdmin.

Cobalt Strike can exploit Oracle Java vulnerabilities for execution, including CVE-2011-3544, CVE-2013-2465, CVE-2012-4681, and CVE-2013-2460.

Cobalt Strike can use `rundll32.exe` to load DLL from the command line.

The Cobalt Strike loader can use the `MessageBoxA` API to prompt for user interaction as an anti-sandbox measure.

The Cobalt Strike System Profiler can discover applications through the browser and identify the version of Java the target has.

Cobalt Strike can install a new service.

Cobalt Strike can use a number of known techniques to bypass Windows UAC.

Cobalt Strike can use sudo to run a command.

Cobalt Strike can perform pass the hash.

Cobalt Strike can use self signed Java applets to execute signed applet attacks.

Cobalt Strike can use spoof arguments in spawned processes that execute beacon commands.

Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services.

Cobalt Strike uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.

Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data.

Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.

Cobalt Strike's execute-assembly command can run a .NET executable within the memory of a sacrificial process by loading the CLR.

Cobalt Strike has the ability to use Smart Applet attacks to disable the Java SecurityManager sandbox.