A Morning with Cobalt Strike & Symantec - Black Hills Information Security
Tags
attack-pattern: Dns - T1071.004 Dns - T1590.002 Domains - T1583.001 Domains - T1584.001 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Trap - T1546.005 Powershell - T1086 Trap - T1154
Show in Graph
Common Information
Type Value
UUID a5953d5d-ace4-4629-a6bc-25c446dc58d6
Fingerprint 2d23b13e229eae8d
Analysis status DONE
Considered CTI value 0
Text language
Published Dec. 4, 2017, midnight
Added to db Jan. 18, 2023, 10:50 p.m.
Last updated Nov. 19, 2024, 3:12 a.m.
Headline A Morning with Cobalt Strike & Symantec
Title A Morning with Cobalt Strike & Symantec - Black Hills Information Security
Detected Hints/Tags/Attributes 47/1/6
Source URLs
Redirection Url
Details Source https://www.blackhillsinfosec.com/morning-cobalt-strike-symantec/
URL Provider
Details Provider Source level domain
Details blackhillsinfosec.com www.blackhillsinfosec.com
Attributes
Details Type #Events CTI Value
Details Domain 12 
www.blackhillsinfosec.com
Details Domain 4135 
github.com
Details Domain 1 
httpsc2doneright.sh
Details Github username 2 
killswitch-gui
Details Url 1 
https://www.blackhillsinfosec.com/build-c2-infrastructure-digital-ocean-part-1
Details Url 1 
https://github.com/killswitch-gui/cobaltstrike-toolkit/blob/master/httpsc2doneright.sh