Principles of operation and detection on the target system of the dual purpose tool Cobalt Strike

DOI: 10.31673/2409-7292.2023.020002

Abstract

The article investigates the nature of the functioning of the dual-purpose tool Cobalt Strike, which actively uses APT (Advanced Persistent Threat) in its arsenal primarily to gain unauthorized access to information systems and their information assets. Considering the extent of the widespread use of Cobalt Strike, it is advisable to consider the principle of its operation and possible measures to counter its penetration into the information systems of objects of critical information infrastructure.

Keywords: dual purpose software tools, malware, Cobalt Strike, lateral movement.

References
1. User Guide “Cobalt Strike 4.5” - [Електрон. ресурс] /“Help Systems”. – Режим доступу: www.helpsystems.com;
2. “How cybercriminals try to bypass antivirus protection - [Електрон. ресурс] – Режим доступу: https://”www.kaspersky.com/resource-center/threats/combating-antivirus;
3. “What is Cobalt Strike and How Does It Work?” - [Електрон. ресурс] – Режим доступу: https://www.netsurion.com/videos/what-is-cobalt-strike;
4. “Hunting and detecting Cobalt Strike” - [Електрон. ресурс] – Режим доступу: https://log.sekoia.io/huntingand-detecting-cobalt-strike/;
5. “Defining Cobalt Strike Components So You Can BEA-CONfident in Your Analysis” - [Електрон. ресурс] – Режим доступу: https://www.mandiant.com/resources/blog/defining-cobalt-strike-components;
6. “Що таке Endpoint Detection and Response” - [Електрон. ресурс] – Режим доступу: https://ua.softlist.com.ua/articles/chto-takoe-endpoint-detection/;
7. Steve Anson“Applied Icident Response”, “Wiley”, 2021, 435 p.