Cobalt Strike: Beacon Detection

CORP-WEB-01 runs a public-facing Confluence server, and an exploitation attempt against it (CVE-2023-22527) gave the attacker code execution as SYSTEM. The first stage abused a signed, built-in Windows utility to pull down and run a remote HTA payload. Trace the process chain under the Confluence web process and identify the legitimate Microsoft binary the attacker repurposed for that initial execution.

Moments after the HTA payload ran, the compromised CORP-WEB-01 host reached out to attacker-controlled infrastructure to establish its beacon. Having confirmed how the host was initially executed, your next step is to scope the C2 channel. Review the XDR Network Events for the outbound connection that left the host right after that first-stage execution and identify the external destination it called home to.

With the C2 channel mapped, you need to characterise what the beacon actually ran. On CORP-WEB-01 the LOLBin you identified spawned a hidden PowerShell process that carried the next stage of the intrusion. To support detection-engineering and threat-intel enrichment, pivot into the XDR Process Tree, locate that PowerShell node in the chain, and record the file hash the EDR captured for it.

The in-memory stage gave the attacker hands-on access, and they began pulling additional tooling onto CORP-WEB-01. During one session the host made an outbound HTTP request to a suspicious external server, and shortly afterward an unrecognised binary appeared in a temporary directory. Work the SIEM event messages for that session and identify the name of the file that was written to the host.

On 2025-01-21 the operator pulled a binary onto CORP-WEB-01 over HTTP and ran it out of the Administrator's Temp directory through cmd.exe. The download and the execution are recorded by different sources, and only one of those records carries a hash. Work the SIEM process-creation events for that execution and record the SHA-256 the endpoint captured for the payload.

After establishing their foothold, the adversary moved toward the backup infrastructure on corp-bkp-01, using a service account to hunt for administrative credentials. Backup servers are a prized target because they hold keys to the wider estate. Examine the XDR timeline for the PowerShell activity tied to that service account and identify the script that was run to extract credentials from the backup software.

With credentials in hand, the attacker turned to moving data out of the estate and staged a third-party transfer utility to copy a sensitive file share to cloud storage. Before you can block and hunt for this tool, you need a reliable identifier for it. Work through the XDR Process Tree, locate the process responsible for the bulk copy, and record the file hash captured for that binary.

You have identified the transfer utility the attacker used; the final step is to determine where the data actually went so the destination can be blocked and reported. That tool, running on CORP-FILE-01, pushed a large volume of data out of the environment in a single transfer. Review the XDR Network Events for the outbound connection it opened and identify the external destination that received the unauthorised upload.