Cobalt strike

Cobalt Strike is a commercial, full-featured, digital offensive platform designed for red team operations. It is a collection of threat emulation tools provided by Strategic Cyber LLC to work with the Metasploit Framework, which is an open-source software project for developing security tools and exploits. The platform is used for advancing an adversary’s operations on an internal network or a target system.

Created by security researcher Raphael Mudge, Cobalt Strike is used by many government and military organizations around the world, as well as numerous corporations. It is considered a powerful tool as it provides options for controlling compromised machines, simulating the tactics and techniques of advanced adversaries, and elevating privileges through post-exploit activities.

The main features of Cobalt Strike include: multi-player collaboration, a scripting engine for advanced automation, Beacon – a cross-platform payload, the ability to execute malicious workflows shortly after gaining access to a machine, an aggregated view of an adversary’s activities, and an audit trail of user actions.

Cobalt Strike is considered to be a popular tool among attackers, and its use is thought to have grown significantly since its introduction in 2011. As such, its capabilities should be known to defenders, allowing them to recognize effects and create tailored defenses.