cobaltstrike manual

Cobalt Strike can recover hashed passwords.

Cobalt Strike uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.

Cobalt Strike can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.

Cobalt Strike can use WinRM to execute a payload on a remote host.

Cobalt Strike includes a capability to modify the Beacon payload to eliminate known signatures or unpacking methods.

Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval.

Cobalt Strike will break large data sets into smaller chunks for exfiltration.

Cobalt Strike can perform port scans from an infected host.

Cobalt Strike can use WMI to deliver a payload to a remote host.

Cobalt Strike can inject a variety of payloads into processes dynamically chosen by the adversary.

Cobalt Strike can track key presses with a keylogger module.

Cobalt Strike's Beacon payload can collect information on process details.

Cobalt Strike can execute a payload on a remote host with PowerShell. This technique does not write any data to disk. Cobalt Strike can also use PowerSploit and other scripting frameworks to perform execution.

Cobalt Strike can timestomp any files or payloads placed on a target machine to help them blend in.

Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS. All protocols use their standard assigned ports.

Cobalt Strike can conduct peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.

Cobalt Strike can use a custom command and control protocol that can be encapsulated in DNS. All protocols use their standard assigned ports.

Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.

Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.

Cobalt Strike can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access.

Cobalt Strike's Beacon payload is capable of running shell commands without cmd.exe and PowerShell commands without powershell.exe Cobalt Strike can also use `CreateThreadpoolWait`, `SetThreadpoolWait`, and `MessageBoxA` for sandbox evasion and execution of embedded payloads in memory.

Cobalt Strike's Beacon payload is capable of capturing screenshots.

Cobalt Strike can steal access tokens from exiting processes.

Cobalt Strike can make tokens from known credentials.

Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.

Cobalt Strike can use a number of known techniques to bypass Windows UAC.

Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services.

Cobalt Strike uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.