Identifying Cobalt Strike team servers in the wild

guest · Feb 28, 2019

Identifying Cobalt Strike team servers in the wild
How an anomalous space led to fingerprinting
January 26, 2019
https://blog.fox-it.com/2019/02/26/identifying-cobalt-strike-team-servers-in-the-wild/

On the 2nd of January 2019 Cobalt Strike version 3.13 was released, which contained a fix for an “extraneous space”. This uncommon whitespace in its server responses represents one of the characteristics Fox-IT has been leveraging to identify Cobalt Strike Servers, with high confidence, for the past one and a half year.

The webserver of the team server in Cobalt Strike is based on NanoHTTPD, an opensource webserver written in Java.
Scanning and results
By utilizing public scan data, such as Rapid7 Labs Open Data, and the knowledge of how to fingerprint NanoHTTPD servers, we can historically identify the state of publicly reachable team servers on the Internet.
Click to expand...

In total Fox-IT has observed 7718 unique Cobalt Strike team server or NanoHTTPD hosts between the period of 2015-01 and 2019-02
The full list of Cobalt Strike team servers identified using this method can be found on the following Fox-IT GitHub Repository.
Click to expand...

guest · Jun 18, 2019

Threat Actors Use Older Cobalt Strike Versions to Blend In
June 18, 2019
https://www.bleepingcomputer.com/ne...use-older-cobalt-strike-versions-to-blend-in/

Plenty of outdated Cobalt Strike servers exist in the wild, helping cybercriminals or giving security professionals the upper hand when testing corporate defenses; and they can be easily identified to stifle intrusions of any purpose.
Identifying unpatched servers
Network defenders should be able to detect and deflect Cobalt Strike activity regardless of the motive behind it. To this end, Recorded Future's Insikt Group scanned the internet searching for clues that may indicate an unpatched server.
By combining multiple methods for detecting the software in the wild, the researchers were able to discover 104 servers they believe were running Cobalt Strike "based on moderately-high to high confidence detections."

The techniques described in the report from Recorded Future may be for unpatched versions of the security testing framework but it does not mean they make for outdated detection routines.
To keep a low profile, attackers often prefer running an older release if other bad actors have not moved to a newer version. Another reason may be that customizations could be lost when upgrading to a new build.
Click to expand...

Recorded Future: A Multi-Method Approach to Identifying Rogue Cobalt Strike Servers

guest · Aug 19, 2019

The Challenges Of Cobalt Strike Server Fingerprinting
August 16, 2019
https://www.itsecurityguru.org/2019/08/16/the-challenges-of-cobalt-strike-server-fingerprinting/

Penetration-testing software and red-teaming frameworks were built for the purpose of testing the defences of enterprise networks, but that hasn’t stopped individuals and collectives with malicious intent from pirating or hacking these tools and using them to nefarious ends.

Cobalt Strike is one such tool that is being widely abused, and if your organisation has not engaged with a penetration-testing or red-teaming firm, it’s crucial that network security specialists learn how to detect potentially illicit traffic and understand the steps threat actors are taking to bypass detection.
Assessment
Given the prevalence and popularity of Cobalt Strike for legitimate and malicious purposes, it is critical to be able to identify as many Cobalt Strike servers as possible.
Although there are a number of well-documented methods for identifying these servers, most rely on server fingerprinting based on Cobalt Strike’s default settings, which can be easily changed. No single method for identifying Cobalt Strike servers is foolproof.
Click to expand...

Log in or Sign up

Identifying Cobalt Strike team servers in the wild

guest Guest

guest Guest

guest Guest

Log in or Sign up

Identifying Cobalt Strike team servers in the wild

guest Guest

guest Guest

guest Guest

Useful Searches