How to detect Cobalt Strike activity

In this page

Threat snapshot

Cobalt Strike is a commercial adversary simulation platform that has become the most widely used post-exploitation framework in real-world attacks. Originally designed for red teams, it was cracked and leaked, and its beacon implant now appears in the majority of financially motivated and nation-state attack chains. When a SIEM vendor or incident responder says they found C2 activity, they are more likely than not referring to Cobalt Strike or a direct derivative.

The Cobalt Strike beacon is a small implant that establishes a command-and-control channel back to a team server operated by the attacker. It supports a wide range of post-exploitation capabilities: process injection, credential dumping, lateral movement, privilege escalation, and file transfer. The beacon's behavior is highly configurable through malleable C2 profiles, which allow operators to customize traffic patterns, user agents, sleep intervals, and process injection targets to blend in with normal network activity.

Despite this configurability, Cobalt Strike leaves consistent artifacts across its deployment patterns: specific named pipe names used for inter-process communication, DNS beaconing patterns with characteristic subdomain structures, service-based persistence mechanisms, and process injection behavior visible in system calls. Log360 maps 59 detection rules to Cobalt Strike activity across these artifact categories.

Cobalt Strike detection, at a glance

Severity Trouble
Category Endpoint & Malware
MITRE ATT&CK tactic TA0011 Command and Control, TA0005 Defense Evasion, TA0003 Persistence
MITRE techniques T1071.001 Web Protocols, T1055 Process Injection, T1543.003 Windows Service
Detection vectors Named pipe patterns, DNS beaconing, service installation, process injection artifacts, LOLBin loading, C2 traffic patterns
Platforms covered Windows, Network
Log360 detection rules 59 rules
SOC maturity level Level 3 - Incident Response
Compliance mapping NIST CSF DE.CM-1, PCI-DSS 10.6, HIPAA Section 164.312(b), ISO 27001 A.12.4.1

How Cobalt Strike operates

Beacon deployment and staging

Cobalt Strike beacons are typically delivered as stageless shellcode or as a staged loader that downloads the full beacon from a team server. Common delivery vehicles include malicious Office documents with macros, PowerShell download cradles, LOLBin loading via Rundll32, and phishing links to drive-by downloads. The Cobalt Strike Load by Rundll32 rule targets the rundll32-based delivery pattern specifically, which is one of the most commonly observed deployment methods.

Named pipes for inter-process communication

Cobalt Strike uses named pipes for communication between injected processes and for SMB-based beacon communication on internal hosts that lack direct internet access. The default named pipe names follow patterns such as \\.pipe\MSSE-XXXX-server, \\.pipe\postex_XXXX, and \\.pipe\msagent_XXXX, where XXXX is a variable component. These default names are well-documented and detectable. The CobaltStrike Named Pipe (Critical) and CobaltStrike Named Pipe Patterns rules target the default and variant pipe name patterns.

DNS beaconing

Cobalt Strike's DNS beacon uses DNS A record queries to communicate with the team server, encoding C2 traffic as subdomains. The subdomain patterns are distinctive: a high volume of queries to a single parent domain, with subdomains that follow alphanumeric patterns of consistent length. The Suspicious Cobalt Strike DNS Beaconing - Sysmon rule (Critical) detects this traffic pattern via Sysmon DNS query logging.

Process injection

Cobalt Strike injects its beacon into running processes to execute in the memory space of a legitimate process, hiding its activity from tools that enumerate running processes. Default injection targets include svchost.exe, explorer.exe, and other common system processes. The injection operation generates specific Windows API calls (OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) that appear in ETW and in tools that monitor process access events. The HackTool - DInjector PowerShell Cradle Execution (Critical) rule targets injection via the DInjector framework, which wraps Cobalt Strike shellcode in a PowerShell-based injection chain.

Service-based persistence

Cobalt Strike can create Windows services to maintain persistence across reboots. The service is typically created using the psexec or psexec_psh Cobalt Strike modules, which generate a service name and binary path that follow identifiable patterns. Service creation events (Event 7045) with service names or binary paths matching Cobalt Strike templates are detectable. The COLDSTEEL RAT Service Persistence Execution (Critical) and related rules cover service-based persistence for Cobalt Strike derivatives and related C2 frameworks.

Real-world campaigns

FIN6 and UNC2452: Cobalt Strike as primary post-exploitation platform

FIN6 and the group tracked as UNC2452 (associated with the SolarWinds supply chain compromise) both used Cobalt Strike extensively as their primary post-exploitation platform. In these operations, Cobalt Strike beacons operated with custom malleable C2 profiles designed to blend their traffic with legitimate Microsoft and CDN traffic patterns, making network-layer detection difficult. The named pipe and process injection artifacts remained detectable on endpoints regardless of the traffic profile customization.

LockBit and other ransomware: Cobalt Strike as the lateral movement platform

Many ransomware groups, including LockBit affiliates and Conti operators before the group's dissolution, use Cobalt Strike as their lateral movement and reconnaissance platform between initial access and ransomware deployment. The beacon is deployed during the post-exploitation phase and used to enumerate the environment, dump credentials, and move laterally before the encryptor is distributed.

APT40: DNS beacon for long-term persistence

APT40, a Chinese APT group, has used Cobalt Strike DNS beacons for long-term persistence in target environments, with beacons configured with long sleep intervals (hours rather than seconds) to generate minimal traffic. The Suspicious Cobalt Strike DNS Beaconing rule detects the subdomain pattern regardless of beacon sleep interval because the DNS query structure is consistent across configurations.

Business impact

  • Cobalt Strike represents an active, interactive attacker presence in the environment: Unlike automated malware, a Cobalt Strike operator is making real-time decisions based on what they discover. Detection of Cobalt Strike activity means there is a human attacker actively working in the environment at that moment.
  • Cobalt Strike's full capability set makes it a complete attack platform: A compromised host running a Cobalt Strike beacon gives the operator credential dumping, lateral movement, privilege escalation, keylogging, screenshot capture, and file transfer capabilities. The damage potential scales with how long the beacon runs undetected.
  • Malleable C2 profiles make traffic-based detection unreliable as a primary detection method: Because beacon traffic can be configured to mimic any web traffic pattern, network-layer detection of Cobalt Strike traffic is difficult without endpoint-based artifact detection. The named pipe, process injection, and service installation artifacts are more reliable because they do not respond to malleable C2 profile configuration.

Detecting Cobalt Strike with Log360

Effective Cobalt Strike detection requires Sysmon deployment with named pipe monitoring (Event 17/18) and DNS query logging (Event 22) in addition to process creation logging. Network-layer detection requires firewall and DNS logs. Without Sysmon named pipe events, the highest-confidence Cobalt Strike artifact (default named pipe patterns) will not be detected.

Rule name Severity Platform MITRE technique What it detects
CobaltStrike Named Pipe Critical Windows T1055 A named pipe matching Cobalt Strike's default pipe name patterns (MSSE-*, postex_*, msagent_*). Default pipe names are used unless an operator explicitly customizes them, making this a high-confidence indicator.
CobaltStrike Named Pipe Patterns Trouble Windows T1055 Broader detection for named pipe names matching Cobalt Strike patterns beyond the specific defaults, catching operators who have partially customized pipe names.
Suspicious Cobalt Strike DNS Beaconing - Sysmon Critical Windows T1071.004 DNS query patterns consistent with Cobalt Strike DNS beaconing: high query volume to a single domain with alphanumeric subdomain patterns of consistent length. Detected via Sysmon DNS query logging.
CobaltStrike Load by Rundll32 Trouble Windows T1218.011 Rundll32.exe loading a DLL matching Cobalt Strike beacon packaging patterns, one of the most common delivery mechanisms for Cobalt Strike in enterprise incidents.
HackTool - DInjector PowerShell Cradle Execution Critical Windows T1055 DInjector framework used to inject Cobalt Strike shellcode into a target process via a PowerShell delivery cradle. Fires on the PowerShell cradle pattern that DInjector uses for shellcode delivery.
HackTool - Credential Dumping Tools Named Pipe Created Critical Windows T1003.001 Named pipe creation matching patterns associated with credential dumping tools that Cobalt Strike operators use alongside the beacon (Mimikatz, SharpKatz, similar tools).
HackTool - Koh Default Named Pipe Critical Windows T1134.001 Default named pipe for the Koh token capture tool, used by Cobalt Strike operators to capture and abuse Windows authentication tokens for privilege escalation.
Mavinject Inject DLL Into Running Process Trouble Windows T1055.001 Mavinject.exe used to inject a DLL into a running process, one of the process injection techniques available through Cobalt Strike's execute-assembly and similar modules.
Network Connection Initiated Via Notepad.EXE Trouble Windows T1055 Notepad.exe making a network connection, indicating process injection into Notepad was used to proxy C2 communication through a trusted process.
COLDSTEEL RAT Service Persistence Execution Critical Windows T1543.003 Service creation by COLDSTEEL RAT, a Cobalt Strike-derivative framework, indicating service-based persistence has been established.
Potential Pikabot Hollowing Activity Trouble Windows T1055.012 Process hollowing activity consistent with Pikabot loader, which is commonly used to deliver Cobalt Strike as its final payload.
Silence.EDA Detection Critical Windows T1059.001 Silence group EDA component execution, associated with a threat actor that uses Cobalt Strike as part of their post-exploitation toolkit.

Investigation playbook

Step 1: Identify the beacon and its injection target

  • For named pipe alerts, identify which process created or connected to the named pipe. If the process is a system process (svchost.exe, explorer.exe, lsass.exe) that would not normally create pipes with Cobalt Strike-pattern names, process injection has occurred. The injected process is the one hosting the beacon in memory.
  • For DNS beaconing alerts, identify the domain being queried and block it at the DNS resolver and firewall immediately. Query all internal hosts for DNS requests to the same domain in the prior 30 days to identify the full scope of beaconing hosts.
  • Collect a memory image of the affected host before any remediation. Cobalt Strike operates in memory and the beacon binary, its configuration including team server address and sleep interval, and any additional injected modules are only recoverable from a memory image.

Step 2: Determine operator activity since beacon deployment

  • Establish the beacon's deployment timestamp from the earliest named pipe, DNS, or process injection event. Query all process creation, network connection, authentication, and file access events on the affected host from that timestamp forward. This timeline represents everything the operator did through the beacon.
  • Check for Cobalt Strike-specific post-exploitation tool execution: Mimikatz invocations (Potential Invoke-Mimikatz PowerShell Script), LSASS access (Potential Credential Dumping Attempt Via PowerShell), lateral movement activity (Event 4624 Type 3, Event 7045 across other hosts).

Response and remediation

  • Isolate the host before notifying the attacker: If Cobalt Strike is detected and an operator is active, any visible remediation action (killing the beacon process, blocking the C2 domain without isolation) may prompt the operator to accelerate their timeline. Isolate the host at the network level first, then proceed with remediation.
  • Treat all credentials on the affected host as compromised: Cobalt Strike's credential dumping modules can extract credentials silently. Assume any credential that was cached or used on the host during the beacon's operational period has been stolen.
  • Identify and check all hosts the beacon operator may have pivoted to: Cobalt Strike's lateral movement capabilities mean the operator may have moved to additional hosts using credentials obtained on the initial host. Check for anomalous authentication events and new named pipe or DNS beacon activity on all hosts in the environment from the beacon's operational period forward.
False positive source Rules affected Tuning strategy
Legitimate red team or penetration test operations CobaltStrike Named Pipe, CobaltStrike Named Pipe Patterns, Suspicious Cobalt Strike DNS Beaconing Require advance written notification for all penetration tests and red team exercises. Create time-bounded exceptions scoped to the specific test IP ranges and host names. Any Cobalt Strike artifact detection outside the documented test scope or after the test window ends must be treated as a real incident.
Security research tools that use similar named pipe patterns CobaltStrike Named Pipe Patterns Review the specific pipe name patterns triggering the alert against known legitimate security tool pipe names. The specific default Cobalt Strike pipe names (CobaltStrike Named Pipe, Critical rule) have essentially no legitimate use case and should not be suppressed.