Cobalt Strike, a Defender’s Guide – Part 2The DFIR Report Real Intrusions by Real Attackers, The Truth Behind the Intrusion Our previous report on Cobalt Strike focused on the most frequently used capabilities that we had observed. In this report, we will focus on the network traffic it produced, and provide some easy wins defenders can be on the look out for to detect beaconing activity. We cover topics such as domain fronting, SOCKS pro
