Its purpose was to help these teams become more advanced in their work to conduct intrusions where they were allowed to carry out an authorized cyber attack on their company or in a consultative role. It was created in 2012 with the intention of aiding pentesters and red teams.

The commercially available adversary emulation software called Cobalt Strike is a perfect example. Type help followed by a command name to get detailed help.Ĭopyright Help/Systems LLC and its group of companies.Īll trademarks and registered trademarks are the property of their respective owners.Throughout history there are many examples of inventions created with good intentions (and maybe still are used for the right purposes) but when in the wrong hands, are used for something more malicious than their original intent. Type help in the Beacon console to see available commands. It’s worth your time to become familiar with its commands. You will likely spend most of your time with Cobalt Strike in the Beacon console. If a teammate issues a command, Cobalt Strike will pre-fix the command with their handle. In its default configuration, the statusbar shows the target’s NetBIOS name, the username and PID of the current session, and the Beacon’s last check-in time.Įach command that’s issued to a Beacon, whether through the GUI or the console, will show up in this window. This status bar contains information about the current session. In between the Beacon console’s input and output is a status bar. The Beacon console is also where command output and other information will appear. The Beacon console allows you to see which tasks were issued to a Beacon and to see when it downloads them. The console is the main user interface for your Beacon session. Right-click on a Beacon session and select interact to open that Beacon’s console. This allows you to cloak Beacon activity to look like other malware or blend-in as legitimate traffic. Redefine Beacon's communication with Cobalt Strike's Interactive communication happens in real-time.īeacon's network indicators are malleable.

Will phone home, download its tasks, and go to sleep. Asynchronous communication is low and slow. You mayĪlso limit which hosts egress a network by controlling peer-to-peer Beacons over Windows named pipes.īeacon is flexible and supports asynchronous and interactive communication. Use Beacon to egress a network over HTTP, HTTPS, or DNS.

Post Exploitation Beacon Covert C2 Payloadīeacon is Cobalt Strikes payload to model advanced attackers.

Cobalt strike beacon