Advisory: Notable Changes and Activity Related to Cobalt Strike

Notable Changes and Activity Related to Cobalt Strike in Q3

Summary

This quarter has been an active one for news related to the Cobalt Strike tool suite. The shape of the Cobalt Strike team changed, improved countermeasures were released publicly, and a new version with significant changes and functionality was released.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

MITRE ATT&CK

Recommendations

• Cobalt Strike heavily leverages other attack tools in their framework. Confirm your organization’s security posture maximizes the ability to detect Mimikatz, Metasploit, and non-standard PowerShell scripts.
• Configure your firewall to utilize Transport Layer Security (TLS) Inspection on all traffic through the perimeter.
• Check for non-standard User Agents in web traffic.
• Examine the Host Headers on web traffic to verify the Host Header destination matches the actual routing destination on web traffic.
• Ensure antivirus and intrusion detection software is up-to-date with all patches and rule sets.
• Enable 2-factor authentication for all of your organizational accounts.
• Utilize account permissions best practices such as role-based access control, least privilege, and restricting root/admin permissions.
• Segment critical network resources using zero-trust configurations.
• Enforce best practices on passwords, such as complexity, forced expiration, and prohibiting password reuse.
• Do not share passwords, and do not reuse the same password on different websites and applications.
• Log and monitor all administrative actions as much as possible. Alert on any suspicious activity.
• Consider disabling, or at least logging, all network activity outside of normal business hours for most users where possible.
• Disable unused ports on Internet-facing devices.
• Disable port echoing on all Internet-facing devices
• If you are alerted or suspect a compromised account, change the password immediately.
• Disable unneeded protocols on your network (UDP, IPX, NetBIOS) and monitor for any use of them.
• Monitor usage of dual purpose tools such as Powershell for abnormal behaviors.
• If you have subscribed to ZeroFox’s new Cyber Threat Intelligence Search library, a curated list of Cobalt Strike Indicators of Compromise can be found here: https://cloud.zerofox.com/intelligence/malware?q=cobaltstrike

Details

Cobalt Strike is a suite of tools developed in 2012 by security researcher Raphael Mudge as a framework to perform and orchestrate security and penetration tests. Over the years, it has become a favorite tool for threat actors as well. It had previously been the fruits of Mudge’s solo effort, but earlier this year ownership was acquired by security vendor Help Systems and became a team effort, followed not much later by Mudge’s (amicable) departure.

Significant development efforts had already occurred in the last year with the release of v4.0, and subsequently additional functionality included in v4.2 and v4.3. In November 2020, a cracked version of the v4.0 source code was leaked onto the dark web (legal licenses of Cobalt Strike run 3500 USD), and the hack to obtain that source code was attributed to the threat actor FreakBoy. This leak, in conjunction with Cobalt Strike’s extensive set of tools and capabilities, are likely largely responsible for the sudden surge in popularity of Cobalt Strike in the criminal underground community.

In what could have been a substantial weapon in defense against Cobalt Strike attacks, a vulnerability was discovered by security researchers that would allow a Denial of Service (DoS) attack against a Cobalt Strike C2 server. The vulnerability was released publicly, however, a patch was quickly developed and released.

A project designed to be very similar to Cobalt Strike was discovered in August 2021. The tool was dubbed Vermilion Strike by the threat researchers at Intezer, and the tool was a re-implementation of the functionalities of Cobalt Strike - particularly Cobalt Strike Beacon, but ported to Linux. An equivalent sample of the port was found for Windows as well. Vermilion Strike is not the first effort to re-implement Cobalt Strike Beacon and its capabilities. Another project called Geacon was released in February, 2020, which recreated the Beacon components in Golang.

This quarter in particular saw the release of v4.4, which included a number of new features. One of the new features was the ability to leverage a user-defined Reflective DLL Loader. A Reflective DLL loader is a feature that allows an attacker to load a DLL and inject it into a victim process entirely from memory, rather than requiring it to be read from disk. Even a standardized reflective DLL loader is a sophisticated attack vector, but by allowing user-defined loaders, detection will potentially be significantly more difficult.

Cobalt Strike also previously had a fairly noticeable event detection centered around the Windows Event for a DNS Query (Sysmon event 22). This feature was modified in v4.4 and no longer triggers that Event code, thus mitigating a reliable forensic investigation technique. And in that same spirit of anti-forensic countermeasures, Cobalt Strike has the ability to hide itself in memory when it is not active, an anti-content matching technique referred to as a sleep mask. The technique does require a small flaw, however, in that it must leave a stub of data in order for it to find itself when it would like to become active. Again, that detection was largely mitigated in version 4.4 by making that stub value able to be user-defined.

The framework continued its integration with the popular tool Mimikatz, but slightly decoupled the integration for improved flexibility. Mimikatz is an independent tool, and has its own development schedule, and in v4.4 Cobalt Strike established a mechanism by which to upgrade the integrated version of Mimikatz without having to break Cobalt Strike.

And in the last feature we will discuss, the capability to reconnect to an established TeamServer instance was added. This capability may be done manually or automatically. As such, a defender’s effort to break a connection may be even less valuable, as previously an attacker would need to realize the broken connection and then work to re-establish it, which would take time and resources. Now, after a brief countdown, the command and control will attempt to reconnect itself with virtually no disruption.

Conclusion

Cobalt Strike is an established threat in the hands of attackers. Now development has surged in earnest with new capabilities and new threats to defend against. There is also an active effort to engage the community, sharing techniques, libraries, scripts, and configurations. There is every reason to believe that Cobalt Strike will continue to grow in popularity both among red teams and threat actors for some time to come, and its presence will continue to adapt and present new challenges to network defenders.