MITRE ATT&CKsoftware (malware)
S0154 Cobalt Strike
- Domain
- enterprise
- Platforms
- Linux, macOS, Windows
- Version
- 1.14
- Created
- 2017-12-14
Description
Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.
In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.
Related
Uses · MITRE ATT&CK (73)
- T1685 Disable or Modify Tools technique
- T1564.010 Process Argument Spoofing sub-technique
- T1620 Reflective Code Loading technique
- T1059.007 JavaScript sub-technique
- T1027.005 Indicator Removal from Tools sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1001.003 Protocol or Service Impersonation sub-technique
- T1071.001 Web Protocols sub-technique
- T1071.002 File Transfer Protocols sub-technique
- T1071.004 DNS sub-technique
- T1572 Protocol Tunneling technique
- T1090.001 Internal Proxy sub-technique
- T1090.004 Domain Fronting sub-technique
- T1132.001 Standard Encoding sub-technique
- T1078.002 Domain Accounts sub-technique
- T1078.003 Local Accounts sub-technique
- T1069.001 Local Groups sub-technique
- T1569.002 Service Execution sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1059.006 Python sub-technique
- T1497.002 User Activity Based Checks sub-technique
- T1069.002 Domain Groups sub-technique
- T1087.002 Domain Account sub-technique
- T1134.001 Token Impersonation/Theft sub-technique
- T1134.003 Make and Impersonate Token sub-technique
- T1134.004 Parent PID Spoofing sub-technique
- T1003.001 LSASS Memory sub-technique
Referenced by MITRE ATT&CK · uses (36)
- G1054 MirrorFace group
- G1053 Storm-0501 group
- G1046 Storm-1811 group
- G1043 BlackByte group
- G1040 Play group
- C0040 APT41 DUST campaign
- G1022 ToddyCat group
- G1020 Mustard Tempest group
- G1021 Cinnamon Tempest group
- C0024 SolarWinds Compromise campaign
- C0021 C0021 campaign
- G1014 LuminousMoth group
- C0018 C0018 campaign
- C0017 C0017 campaign
- C0015 C0015 campaign
- G1006 Earth Lusca group
- G0143 Aquatic Panda group
- G0129 Mustang Panda group
- G0119 Indrik Spider group
- G0114 Chimera group
- G0102 Wizard Spider group
- G0096 APT41 group
- G0092 TA505 group
- G0073 APT19 group
- G0079 DarkHydrus group
- G0080 Cobalt Group group
- G0065 Leviathan group
- G0067 APT37 group
- G0052 CopyKittens group
- G0050 APT32 group