Cobalt Strike: What It Is, How Attackers Use It, and How to Detect It

Cobalt Strike is commercial adversary simulation software, sold by Fortra to vetted red teams, that gives an operator remote control of compromised Windows machines through an in-memory implant called Beacon. Beacon calls home over HTTP, HTTPS or DNS, or chains through another Beacon over SMB named pipes or TCP, picks up tasks and reports back, so one product covers the whole command-and-control (C2) job. It was built for authorized testing, but cracked copies became a standard ransomware tool, and MITRE ATT&CK lists 30 threat groups that have used it, from state-backed APT29 and APT41 to the ransomware crew Wizard Spider.

Whether your monitoring would catch an implant behaving like Beacon is what a red team assessment measures, from $12,500, fixed in writing. A purple team assessment runs the same behaviors openly with your SOC.

What Cobalt Strike is

Fortra’s user guide, which documents version 4.13 as of November 2026, describes a platform for adversary simulations and red team operations that emulates the post-exploitation actions of advanced threat actors. Google’s analysts traced releases back to version 1.44, circa 2012. It is not open source: Fortra vets buyers, and licensed users must follow usage restrictions and export controls, according to Microsoft.

Mandiant’s guide to Cobalt Strike components explains each part; only some touch your network:

Component	What it does	What defenders can see
Team server	The operator’s backend; operator clients connect on TCP 50050 by default	Threat intelligence and internet scanning, rarely your logs
Beacon	The implant on the compromised host, usually only in memory	Process behavior, injection, named pipes, outbound connections
Listeners	How Beacon reaches the team server: HTTP or HTTPS, DNS, SMB, raw TCP	Proxy, DNS, firewall and endpoint network logs
Malleable C2 profile	Settings that reshape Beacon’s traffic to imitate real services	Traffic that looks legitimate but often has tells
Redirectors	Relay servers that hide the team server’s address	When used, usually the only attacker infrastructure in your logs

Cobalt Strike Beacon and C2: how the implant behaves

Beacon arrives through a small stager that fetches the full implant (the same kind of payload msfvenom builds for Metasploit), or a loader that runs it directly in memory, so little touches disk. Four behaviors define it:

• Asynchronous check-ins. Beacon sleeps, wakes, collects queued tasks and sleeps again. Jitter randomizes each interval by up to a set percentage, so check-ins never land on a fixed beat. Patient operators sleep for hours.
• Peer-to-peer chaining. An SMB Beacon listens on a named pipe and relays through a parent Beacon, so hosts without internet access can still be controlled.
• Sacrificial processes. For many post-exploitation jobs, Beacon starts a short-lived process (rundll32.exe by default, but configurable) and injects the job into it. A common binary launched without its usual arguments, then injected into, is a high-value hunt when operators use defaults.
• Built-in tradecraft. ATT&CK maps Cobalt Strike to more than 50 techniques, including process injection (T1055), token impersonation (T1134.001), service execution (T1569.002), SMB admin shares (T1021.002) and LSASS credential dumping (T1003.001). Process injection and token impersonation double as privilege escalation techniques.

Experienced operators sidestep sacrificial processes with Beacon Object Files, compiled C programs that Fortra documents as running inside the Beacon process, and the default sleep mask obfuscates Beacon in memory while it sleeps. Process-creation hunts catch default use; pair them with EDR memory scanning and alerts on executable memory not backed by a file.

Cobalt Strike C2 profiles make signatures alone unreliable, but defaults still give careless operators away. Red Canary’s Cobalt Strike threat page notes that hunters find team servers by the default TLS certificate, port 50050 and default JARM fingerprints, and that while many adversaries change these defaults, it still often finds some who don’t. Payloads also carry a license watermark; Mandiant notes that a matching watermark points to a shared license file, not necessarily the same operator.

Why attackers use it: cracked copies and ransomware

Cracked copies, typically at least one release behind Fortra’s current version, turned Cobalt Strike into a ransomware staple. In November 2022 Google published 165 detection signatures, built from 34 releases it located and aimed at the older versions criminals run rather than the current release paying customers used.

On March 31, 2023, a federal court in New York granted Microsoft, Fortra and Health-ISAC an order to disrupt servers running cracked copies. Microsoft linked ransomware tied to those copies to more than 68 attacks on healthcare organizations in more than 19 countries, naming Conti and LockBit. The #StopRansomware advisory on Black Basta, whose affiliates had hit more than 500 organizations by May 2024, lists Cobalt Strike beacons among the tools affiliates used. Our ransomware statistics page tracks how often those intrusions end in encryption and payment.

The trend has turned. Red Canary’s Cobalt Strike page, last updated in 2023, called it the only post-exploitation framework in its top 10 threats; in its 2026 report, covering 2025, it no longer makes the top 10. The techniques live on in Sliver, Havoc and other frameworks (compared in our red team tools guide), and the same service-install and SMB moves are in the open-source Impacket toolkit, so detection should target behavior rather than one product.

What finding Cobalt Strike reveals about your environment

A real Beacon on your network is an active incident, not a vulnerability. In ransomware cases it usually marks the hands-on stage before encryption (see how modern ransomware attacks work). Containment and forensics belong to an incident response firm, often one on your cyber insurer’s panel; Invadel does not provide incident response.

Criminal or red team, each stage a Beacon completed points at a control that failed:

What happened	What it tells you	The fix
Beacon ran from a phishing attachment or loader	Endpoint protection missed in-memory execution	EDR in block mode with memory scanning; application control
It reached a team server still on default settings	Nobody matches traffic against known Cobalt Strike infrastructure	Check proxy and firewall logs against threat intelligence and default certificates
SMB Beacons chained between workstations	Workstations can reach each other over SMB	Host firewall rules blocking workstation-to-workstation SMB
It moved to servers by installing services	One account had local admin rights on many hosts	Tiered administration, LAPS, alerts on new services
It read credentials from LSASS (the Mimikatz technique)	Credential protections were off	LSA protection and Credential Guard
Sleep and jitter kept check-ins quiet for days	Nobody hunts for rare, regular destinations	The rare-destination beaconing hunt below

The identity fixes in that table, tiered administration and LAPS, are in our Active Directory hardening checklist, each with a way to verify it.

What to do in the first hour if you find Cobalt Strike

If nobody signed a test authorization, assume a person is at the keyboard. The order below follows the response checklist in the joint CISA, NSA, FBI and MS-ISAC #StopRansomware Guide:

1. Rule out an authorized test. Ask whoever owns security testing. A licensed red team has written rules of engagement and a named contact who can confirm in minutes.
2. Isolate, do not power off. Take affected hosts off the network with EDR containment or at the switch. Shutting down erases memory, where Beacon and its configuration live, so the guide keeps it as a last resort for hosts that cannot be disconnected.
3. Coordinate out of band. Use phone calls, not the email or chat an intruder may be reading, and isolate hosts together so the operator is not warned one machine at a time.
4. Preserve evidence. Capture memory and a disk image from a sample of affected hosts, and export proxy, DNS, firewall and EDR logs before they roll over.
5. Scope outward from the Beacon. Search other hosts for the same destination, pipe name and parent process, and for new services or type 9 logons that started from the affected machine, using the detection table below.
6. Call for help and report. Bring in your incident response firm and cyber insurer, and report to CISA and your local FBI field office.

Cobalt Strike detection: behaviors, log sources and event IDs

Capable operators customize, so lasting detection looks for what Beacon still has to do:

Behavior	Log source and event ID	What to look for
Sacrificial process, then injection	Sysmon 1 or Security 4688 (with command lines); Sysmon 8 (CreateRemoteThread) for injection into running processes	rundll32.exe or another common binary started with no arguments by an odd parent, or a remote thread created in a long-running process
Credential theft	Sysmon 10 (ProcessAccess)	Unexpected processes opening lsass.exe
SMB Beacon and job pipes	Sysmon 17 and 18 (pipe created, connected)	Default names Red Canary lists, such as msagent_, postex_, status_ and MSSE-, or random pipe names on workstations
Lateral movement through services	Security 4697, System 7045 (service installed)	A service installed remotely by an account that does not normally administer the host, running a PowerShell one-liner or an executable from an unusual folder; Fortra’s lateral movement documentation lists both service methods
Impersonation with other credentials	Security 4624 logon type 9 (NewCredentials), 4648	Type 9 logons started by processes that are not admin tools
PowerShell jobs	PowerShell Operational 4104 (script block logging)	Encoded or download-and-run script blocks from unexpected parents
HTTPS or DNS beaconing	Sysmon 3 (off by default) and 22, proxy and resolver logs	Regular callbacks to one rare destination from a non-browser process; scoring method in our C2 server guide

Microsoft’s Sysmon reference defines each event and notes that network connection logging stays off until configured.

How to prevent Cobalt Strike, layer by layer

1. Stop execution. EDR in block mode, not audit, with memory scanning, plus application control. Microsoft’s attack surface reduction rules block Office code injection and process creation from PsExec and WMI.
2. Protect credentials. LSA protection and Credential Guard; the LSASS attack surface reduction rule is the fallback where they cannot run.
3. Starve the channel. Default-deny server egress, an authenticated proxy for workstations, DNS only through your own resolvers.
4. Break the chain. Block SMB between workstations, limit WinRM to admin jump hosts (see how attackers abuse WinRM), and remove standing local admin rights.
5. Log what the map needs. Sysmon events 3, 8, 10, 17, 18 and 22, process command lines and script block logging, centralized and retained.
6. Test the detections. Run each row of the detection table against your own SOC and confirm an alert reaches a person.

How Invadel tests for it, and what it costs

A standard penetration test, where IT knows testing is under way, cannot tell you whether your SOC would catch a C2 implant (our red teaming vs penetration testing comparison explains the difference). In a red team assessment, our operators run a C2 implant through your environment using the behaviors above while your team defends for real, with techniques chosen to match your threat model (see offense in depth). The report times detection and response for each phase and maps every timestamped technique to MITRE ATT&CK, so you see which detection-table rows fired.

Engagement	What it answers	Starting price
Red team, Small	One objective, one or two access vectors: would a Beacon-style implant be caught?	$12,500
Red team, Medium	Several objectives, phishing plus external and internal phases: is the implant caught moving to servers?	$17,000
Red team, Large	Multi-scenario, large or multi-site estate, deep evasion, purple-team debrief	$29,000+
Purple team assessment	Each behavior run openly with your defenders, detections tuned and re-run until they fire	Quoted
Ransomware readiness assessment	Assumed breach: the path to Domain Admin, whether backups can be reached	$6,000
Internal network penetration test	Every path from a foothold, with IT aware	$6,000

Implants run only on systems named in the written rules of engagement. Every price is fixed in writing, with reports, an attestation letter and a free retest of remediated technical findings included; see the red team pricing, a sample report or the cost calculator.

Frequently asked questions

Is Cobalt Strike malware? Not by design, but cracked copies used without permission work as malware. If you find it and nobody signed a test authorization, treat it as an intrusion.

Is Cobalt Strike legal, and who can buy it? Using a licensed copy for authorized testing is legal. Only organizations Fortra has vetted can buy a license, and they stay bound by its usage terms and export controls. Using any copy against systems you are not authorized to test is illegal.

What is a Cobalt Strike beacon? Beacon is the implant on a compromised host, usually running only in memory. It checks in with the team server over HTTP, HTTPS or DNS, or through another Beacon over SMB or TCP, collects tasks and returns results. “A beacon” also means one live callback session.

What should I do if Cobalt Strike is detected on my network? Confirm there is no authorized test, then treat it as an intrusion: isolate the affected hosts without powering them off, preserve memory and logs, and call your incident response firm. The first-hour list above gives the order.

What ports does Cobalt Strike use? No fixed port. Operator clients reach the team server on TCP 50050 by default, but Beacon talks out over whatever its listener is set to, commonly HTTP or HTTPS on 80 and 443 or DNS on 53, and between hosts over SMB named pipes or an operator-chosen TCP port. Blocking by port does not work; hunt for the behavior.

Can antivirus detect Cobalt Strike? Default and cracked Beacons, usually. Customized ones, much less reliably, because C2 profiles and custom loaders change what a signature sees. Behavior-based EDR and the detections above catch what signatures miss.

Is Cobalt Strike the same as Cobalt? No. Cobalt Strike is Fortra’s adversary simulation software; Cobalt (cobalt.io) is a penetration testing as a service company, covered in our Cobalt comparison.

Do red teams use Cobalt Strike? Many do, and open-source frameworks such as Sliver fill the same role. The brand matters less than whether the techniques match your threat model and how the team keeps every implant inside the agreed scope.

The short version

Cobalt Strike is Fortra’s commercial red team platform, and its Beacon implant has been one of the most abused post-exploitation tools in ransomware and state-backed intrusions. It is caught by behavior, not by name: sacrificial processes and injection, unusual named pipes, new services, type 9 logons and rare-destination beaconing. To learn whether your team would catch it, a red team assessment starts at $12,500, fixed in writing with a free retest. Send your scope for a fixed quote.