In this blogpost, we describe step by step how to ensure a proactive and defensive posture against Cobalt Strike, one of the most powerful pentesting tools hijacked by attackers in their numerous campaigns. Here, we are tackling a much bigger threat given the frequency it is abused by diverse threat actors. *Please note: Due to the nature of these workshops, many have a capacity limit, so to help us offer this opportunity to as many people as possible, we are asking that you please only register if you plan to attend live.In the last SEKOIA.IO Threat & Detection Lab we dealt with a Man-in-the-middle (MITM) phishing attack leveraging Evilginx2, an offensive tool allowing two-factor authentication bypass. Examples will be given using SANS Linux-based SIFT virtual machine available here: Lab materials should be downloaded here: Īn optional final part of the workshop will include working with Cobalt Strike beacon malware. Install a tool capable of viewing and filtering CSV files (this is particularly important for attendees who do not have a system running the Windows OS).

Download and install Microsoft Sysinternals Sysmon: '.Download and install Event Log Explorer '.A host or virtual machine running a Windows 64-bit operating system (Win7-Win10).System Requirements: Prior to the workshop, participants should prepare the following: Some familiarity with Windows event log is desirable. Prerequisites: Participants will need a system running the Windows operating system to perform Windows event log analysis (virtual machines are okay).While logs will be provided in CSV format for attendees without access to Windows, your experience will be greatly diminished without native access to Windows logging libraries. Whether you are just starting out in threat hunting or a FOR508 alumni, there will be something for everyone in this new workshop! This workshop will leverage data sourced from SANS FOR508: Advanced Incident Response, Threat Hunting and Digital Forensics to provide insight into how Cobalt Strike operates and how to detect many of its characteristics via endpoint logs. Cobalt Strike is an extremely capable and stealthy tool suite, but log analysis can level the playing field, providing many opportunities for detection. Cobalt Strike has become the attack tool of choice among enlightened global threat actors, making an appearance in almost every recent major hack.

Cobalt strike training