As #CobaltStrike remains a premier post-exploitation tool for malicious actors trying to evade threat detection, new techniques are needed to identify its Team Servers. To this end, we present new techniques that leverage active probing and network fingerprint technology. This is a fundamental change from previous passive traffic detection approaches.
Unit 42Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild