dns-beacon: After Cobalt Strike v4.3, DNS options became part of the dns-beacon transaction.

The values listed in this transaction are customizing the HTTP communication for downloading the beacon. The stager downloads the file and injects it into memory.

http-stager: The Beacon is a staged payload.

Below are example transactions, as well as brief explanations of their usage: In addition to these options, a profile can specify different protocol-transactions to carry out different actions. An example of a generic structure of the profile is as follows: The profile is divided into multiple sections to specify the values for different parts of the C2 communications.

Local option changes within one transaction do not affect the output from other transactions. Global options update the global Beacon settings, while local options are transaction-specific. Within a profile, options are divided into global options and local options.

The profile specifies how the beacon will transform and store data in a transaction.

The tool uses the values present in the profile to generate the Beacon payload, and users create the profile and set its values with a Malleable Command and Control (C2) profile language. The Cobalt Strike tool’s primary configuration is specified using a profile file. Related Unit 42 TopicsĪdditional Resources Profile Options for Cobalt Strike

Palo Alto Networks customers receive protections against malicious uses of Cobalt Strike through Cortex XDR and the WildFire and Threat Prevention subscriptions for the Next-Generation Firewall. In doing so, we demonstrate how the Malleable C2 profile lends versatility to Cobalt Strike, and why this versatility makes Cobalt Strike an effective emulator for which it is difficult to design traditional firewall defenses. In this blog post, we will go through the concepts and definitions associated with these profiles, and explore differences between default and customized Malleable C2 profiles used in the Cobalt Strike framework as well as in some true attacks in the wild. Due to its versatility, Cobalt Strike is commonly used as a legitimate tool by red teams – but is also widely used by threat actors for real-world attacks.Ĭobalt Strike users control Beacon’s HTTP indicators through a profile, and can select either the default profile or a customizable Malleable C2 profile. This actor, known as Beacon, communicates with an external team server to emulate command and control (C2) traffic. Cobalt Strike is commercial threat emulation software that emulates a quiet, long-term embedded actor in a network.

Cobalt strike download windows