Cobalt Strike Beacon Investigation

When You See This

1. 1

   Network monitoring detects regular HTTP/HTTPS callback intervals (default 60 seconds) to an external IP or domain

2. 2

   XDR alerts on named pipe creation with Cobalt Strike default patterns (\.pipemsagent_*)

3. 3

   Process injection detected: legitimate process loading unexpected DLLs or exhibiting unusual memory patterns

4. 4

   DNS beaconing to a domain with high query frequency and low TTL values

5. 5

   EDR detects rundll32.exe or regsvr32.exe loading shellcode from unusual paths

Investigation Steps

1. 1

   Confirm beaconing behavior in network traffic

   Analyze network connections from the suspected host. Cobalt Strike beacons have configurable but often identifiable patterns: regular callback intervals (with jitter), HTTP headers that mimic legitimate traffic but contain malleable C2 profiles, and consistent data sizes. Calculate the interval between connections to the suspect destination.

   SIEMFirewall

   Splunk SPLMicrosoft KQLElastic Lucene

   index=firewall src_ip="suspect_host" dest_ip="suspect_c2" | sort _time | delta _time AS interval | stats avg(interval) as avg_beacon_interval, stdev(interval) as jitter, count by dest_ip, dest_port

   index=proxy src_ip="suspect_host" | stats count by url, http_method, bytes_out, bytes_in | where count > 50 | sort -count

   Decision Point

   If: Regular beaconing pattern confirmed with consistent intervals and jitter

   Yes → High confidence Cobalt Strike or similar C2. Proceed to endpoint analysis immediately.

   No → May be legitimate application behavior. Check the destination against threat intelligence before closing.

2. 2

   Analyze the endpoint for beacon artifacts

   Examine the suspect host for Cobalt Strike artifacts: injected processes (typically svchost.exe, rundll32.exe, or explorer.exe with injected code), named pipe creation matching CS defaults, and unusual spawned processes. Check for in-memory-only execution patterns.

   XDR

   Splunk SPLMicrosoft KQLElastic Lucene

   index=endpoint dest_host="suspect_host" (process_name="rundll32.exe" OR process_name="regsvr32.exe") | where NOT match(command_line, "known_legitimate_patterns") | table _time, process_name, command_line, parent_process_name, process_hash

   index=endpoint dest_host="suspect_host" EventCode=17 PipeName="\\*\\pipe\\msagent*" OR PipeName="\\*\\pipe\\MSSE-*" | table _time, PipeName, process_name

3. 3

   Identify the C2 infrastructure

   Research the destination IP/domain. Check threat intelligence for known Cobalt Strike team servers. Examine the TLS certificate; Cobalt Strike defaults generate identifiable certificate patterns. Check if the domain was recently registered or uses bulletproof hosting.

   SIEMFirewall

   Splunk SPLMicrosoft KQLElastic Lucene

   index=firewall OR index=proxy dest="suspect_c2" | stats dc(src_ip) as unique_sources, sum(bytes_out) as total_exfil by dest, dest_port | sort -unique_sources

4. 4

   Search for additional infected hosts

   The critical step; one Cobalt Strike beacon usually means more. Search all endpoints for connections to the same C2 infrastructure. Check for lateral movement from the initially compromised host. A single beacon is concerning; multiple beacons across hosts means the attacker has been operating for some time.

   SIEMFirewallXDR

   Splunk SPLMicrosoft KQLElastic Lucene

   index=firewall dest_ip="c2_server_ip" | stats count by src_ip | sort -count

   index=endpoint parent_process_name="beacon_process" | stats count by dest_host, process_name, command_line

5. 5

   Contain and eradicate

   Isolate all infected hosts from the network simultaneously; if you isolate one at a time, the attacker may notice and accelerate their operations on remaining hosts. Block the C2 domain and IP at the firewall. Collect memory dumps before remediation for forensic analysis. Coordinate with incident response for full eradication.

   XDRFirewall

Common Mistakes

1. 1

   Isolating only the first beacon host without searching for others; Cobalt Strike deployments typically involve multiple beacons

2. 2

   Blocking the C2 domain without checking for DNS-based or SMB-based backup channels

3. 3

   Not collecting memory dumps before isolating; Cobalt Strike beacons are often memory-resident only and evidence is lost on reboot

4. 4

   Assuming the beacon was from a legitimate penetration test without verifying with the security team

Escalation Criteria

• Any confirmed Cobalt Strike beacon; this indicates active post-exploitation operations

• Multiple hosts beaconing to the same C2 infrastructure

• Evidence of credential harvesting or lateral movement from beaconed hosts

Frequently Asked Questions

Why is Cobalt Strike so commonly used by attackers?

Cobalt Strike provides a complete post-exploitation toolkit: command and control, lateral movement, credential harvesting, and data exfiltration, all in one package. Cracked copies are widely available, and its malleable C2 profiles can mimic legitimate traffic, making detection challenging. It was used in the SolarWinds attack, Colonial Pipeline ransomware, and by APT29, APT41, and FIN7.

How do I distinguish a real attack from a penetration test?

Always verify with your security team and any authorized penetration testing vendors before closing an alert. Legitimate pentesters typically register their testing IP ranges and time windows. If no authorized test is running, treat every Cobalt Strike beacon as a real threat.

How do I practice Cobalt Strike detection?

SOCSimulator includes scenarios with realistic C2 beaconing patterns that mimic Cobalt Strike traffic. Practice identifying beacons in SIEM and firewall logs under time pressure. Start free.