software

Cobalt Strike

activeentity:software

[Cobalt Strike](https://attack.mitre.org/software/S0154) is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.(Citation: cobaltstrike manual)

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: cobalt-strike
kind: software
status: active
aliases: —
jurisdictions: —
claims naming it: 0 · 0 attributions · 30 relations · 0 events

Identifiers

attack S0154via mitre-attack

Relations

MITRE ATT&CK Enterpriserecords thatINDRIK SPIDERusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_8btcintel:relations:8@v1 sha256:2955bd0508e67679
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatBlackByteusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_13btcintel:relations:13@v1 sha256:7fd624cf910e1b66
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatMustard TempestusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_36btcintel:relations:36@v1 sha256:9095a0df9f6bd708
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT41usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_76btcintel:relations:76@v1 sha256:02fd4ebcdc6c61b0
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatmenuPassusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_98btcintel:relations:98@v1 sha256:9c9c6a7cf7376f44
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT32usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_104btcintel:relations:104@v1 sha256:0d0cb5080f085a2d
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatFIN6usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_140btcintel:relations:140@v1 sha256:b10f85cea8574212
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatStorm-1811usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_150btcintel:relations:150@v1 sha256:c8301ee3e11c7b96
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatFIN7usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_159btcintel:relations:159@v1 sha256:1388a44ab87ebdbc
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_183btcintel:relations:183@v1 sha256:ac4a09e1998ac0c0
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatMUSTANG PANDAusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_199btcintel:relations:199@v1 sha256:372bac5648da0b59
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT37usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_251btcintel:relations:251@v1 sha256:0985200bd4d7dc93
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAquatic PandausesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_299btcintel:relations:299@v1 sha256:9d1960328fa565c1
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatDarkHydrususesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_319btcintel:relations:319@v1 sha256:9289b3074698dc7d
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLeviathanusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_333btcintel:relations:333@v1 sha256:740518862c3d5fe4
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatStorm-0501usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_362btcintel:relations:362@v1 sha256:148b2f160c6412f2
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatTA505usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_371btcintel:relations:371@v1 sha256:4fc53068054d1031
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT29usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_408btcintel:relations:408@v1 sha256:a7f2de86f6a35554
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatCinnamon TempestusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_424btcintel:relations:424@v1 sha256:b7446dbf86965f2a
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatChimerausesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_426btcintel:relations:426@v1 sha256:a33ae076cccc30a6
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatMirrorFaceusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_427btcintel:relations:427@v1 sha256:569bc814154c0d9a
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatToddyCatusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_476btcintel:relations:476@v1 sha256:eaa8f639acc57399
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLuminousMothusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_483btcintel:relations:483@v1 sha256:997d0c679b4165dc
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatEarth LuscausesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_567btcintel:relations:567@v1 sha256:dfefcde64afa66bc
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatCobalt GroupusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_576btcintel:relations:576@v1 sha256:8523c4dbde71ca30
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatCopyKittensusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_577btcintel:relations:577@v1 sha256:6bb6dc6f88356fab
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatWIZARD SPIDERusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_590btcintel:relations:590@v1 sha256:8b154bfba69bf3da
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatplayusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_609btcintel:relations:609@v1 sha256:1630179897f411ad
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatThreat Group-3390usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_645btcintel:relations:645@v1 sha256:ab48556e7f745c45
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT19usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_667btcintel:relations:667@v1 sha256:426cc625fbd8913c
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.