thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Cobalt Strike

A commercial adversary simulation framework whose Beacon payload is widely abused by real attackers for command and control.

Definition

Cobalt Strike provides Beacon implants, malleable C2 profiles, lateral movement and post-exploitation features for red teams. Cracked copies are used extensively by ransomware and APT groups, making Beacon detections a high-priority incident. Defenders hunt for named pipes, default certificates, JA3/JA4 fingerprints and in-memory signatures.

Example

An EDR alert for a Beacon reflectively loaded into rundll32.exe on a domain controller.

Exam tip

A Cobalt Strike detection usually means hands-on-keyboard intrusion and imminent ransomware; escalate immediately.

Related terms