Skip to content
Threat Feed

Tag

Cobaltstrike

2 briefs RSS
high advisory

Detection of Default Cobalt Strike PowerShell Beacon

This brief outlines detection strategies for default Cobalt Strike PowerShell beacons, which are used for command and control, by identifying specific function and variable names within PowerShell script block logs.

Splunk Enterprise +2 cobaltstrike powershell beacon commandandcontrol windows
2r 2t
high advisory

Cobalt Strike PowerShell Loader Detection

This brief details a detection for a PowerShell loader pattern commonly used with Cobalt Strike to decompress and execute payloads, often observed in scripted web delivery attacks.

Splunk Enterprise +2 cobaltstrike powershell malware windows
2r 2t