Malware

Cobalt Strike

Also known as: Agentemis · BEACON · CobaltStrike · cobeacon

IoCs CSV 1 YARA rule

Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit. The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.

Indicators of Compromise 1

Package jackson-json

YARA Detection Rules

Cobalt_Strike_YARA_Detection
yara ai_generated 
rule Cobalt_Strike_Detection {
    meta:
        description = "Detects Cobalt Strike beacon artifacts and network indicators commonly observed in post-exploitation traffic"
        author = "AI Generated"

    strings:
        $beacon_http_get = /GET [^\r\n]+\/[a-zA-Z0-9]{1,4}\/[a-zA-Z0-9]{4,8}\/[a-zA-Z0-9]{4,8} HTTP\/1\.1/
        $beacon_post_uri = /POST [^\r\n]+\/[a-zA-Z0-9]{4,} HTTP\/1\.1/
        $beacon_get_uri = /GET [^\r\n]+\/[a-zA-Z0-9]{4,} HTTP\/1\.1/
        $user_agent_cs = "User-Agent: Java/" wide ascii
        $json_post_header = "Content-Type: application/json" ascii
        $x_forwarded_for = "X-Forwarded-For:" ascii
        $header_connection = "Connection: close" ascii
        $beacon_config = { 60 6C 6E 6B [0-256] 73 65 72 76 65 72 } // '<lnk'... 'server' in beacon config
        $jackson_json_ioc = "jackson-json" ascii wide

    condition:
        (beacon_http_get or beacon_post_uri or beacon_get_uri) and
        (user_agent_cs and header_connection) and
        (json_post_header or $jackson_json_ioc) and
        $beacon_config
}

⚠ Rules are AI-generated and unvalidated. Test in a safe environment before production use.

Source Articles

Maven Support Comes to GitHub Checks and OSS Package Search
The Java ecosystem is increasingly targeted by supply chain attacks, as demonstrated by the Shai-Hulud worm's second wave and a malicious lookalike of the Jackson JSON library published to Maven Central. These attacks leverage compromised or freshly published dependencies to deliver payloads such as Cobalt Strike, exploiting the window between publication and detection. Traditional vulnerability scanners are often too slow to respond, making real-time protection critical. StepSecurity now extends its Maven support to GitHub Checks and OSS Package Search to block compromised and newly published malicious Java dependencies during pull requests.
step-security ·4d ago