Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
RAT

Cobalt Strike

RAT Needs review 167 detections found
This entry hasn't been reviewed yet. It was auto-detected from the MITRE ATT&CK catalog because it self-identifies as rat-type malware, but no one has curated a full summary or double-checked its reference links. Treat the details below as a starting point, not a verified profile.

Also known as: Cobalt Strike

Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0154) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's currently known; a proper summary and authoritative eradication references are pending.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

Detection rules

Source Rule Status Updated
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 19 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 18 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 18 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 17 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 17 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 22 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 16 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 16 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 15 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 15 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 14 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 14 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 13 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 13 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 12 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 12 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 4 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 3 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 3 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 20 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 21 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 2 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 21 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 22 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 22 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 2 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 21 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 20 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 1 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 19 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 1 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 18 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 17 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 16 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 15 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 14 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 13 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 12 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 11 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 6 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 5 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 4 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 3 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 2 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 1 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 20 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 19 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 11 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 10 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 10 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 9 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 9 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 8 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 8 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 7 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 7 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 6 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 6 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 5 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 11 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 5 rev 1746 2026-10-01
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 4 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 10 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 9 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 8 rev 1746 2026-10-01
suricata ET Threatview.io High Confidence Cobalt Strike C2 IP group 7 rev 1746 2026-10-01
elastic Potential Self-Signed TLS Certificate Recently Issued on External Connection production 2026-09-18
elastic Default Cobalt Strike Team Server Certificate production 2026-09-18
elastic Cobalt Strike Command and Control Beacon production 2026-09-18
suricata ET MALWARE Observed Cobalt Strike CnC Related Domain in DNS Query rev 1 2026-09-17
snort ET TROJAN Observed Cobalt Strike CnC Related Domain in DNS Query rev 1 2026-09-17
splunk Cisco NVM - Suspicious Network Connection From Process With No Args production 2026-07-14
splunk Powershell Remote Thread To Known Windows Process production 2026-07-01
splunk PowerShell Loading DotNET into Memory via Reflection production 2026-06-29
splunk Windows Default Cobalt Strike PowerShell Beacon production 2026-05-13
splunk CMD Echo Pipe - Escalation production 2026-05-13
splunk DLLHost with no Command Line Arguments with Network production 2026-05-13
splunk GPUpdate with no Command Line Arguments with Network production 2026-05-13
splunk Rundll32 with no Command Line Arguments with Network production 2026-05-13
splunk SearchProtocolHost with no Command Line with Network production 2026-05-13
splunk Services Escalate Exe production 2026-05-13
splunk Suspicious DLLHost no Command Line Arguments production 2026-05-13
splunk Suspicious GPUpdate no Command Line Arguments production 2026-05-13
splunk Suspicious Rundll32 no Command Line Arguments production 2026-05-13
splunk Suspicious Rundll32 StartW production 2026-05-13
splunk Suspicious SearchProtocolHost no Command Line Arguments production 2026-05-13
splunk Windows Cobalt Strike PowerShell Loader production 2026-05-13
splunk Windows Command Obfuscation with Environment Variable Substrings production 2026-05-13
splunk Windows Steal Authentication Certificates CryptoAPI production 2026-05-13
splunk ProxyShell ProxyNotShell Behavior Detected production 2026-05-13
suricata ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 rev 6 2024-05-04
suricata ET MALWARE [PTsecurity] Possible Cobalt Strike payload rev 6 2024-05-02
suricata ET MALWARE NOBELIUM - Cobalt Strike Malleable Profile M1 rev 4 2024-04-30
suricata ET MALWARE NOBELIUM - Cobalt Strike Malleable Profile M2 rev 3 2024-04-30
snort ET TROJAN NOBELIUM - Cobalt Strike Malleable Profile M2 rev 3 2024-04-30
suricata ET MALWARE Cobalt Strike Malleable C2 Amazon Profile rev 6 2024-04-28
suricata ET MALWARE Cobalt Strike Malleable C2 Webbug Profile rev 7 2024-04-28
suricata ET MALWARE Cobalt Strike Beacon Activity rev 2 2024-04-24
suricata ET MALWARE [eSentire] Cobalt Strike Beacon rev 6 2024-04-22
suricata ET MALWARE Cobalt Strike Exfiltration rev 4 2024-04-21
suricata ET MALWARE Cobalt Strike Malleable C2 OCSP Profile rev 7 2024-04-14
suricata ET MALWARE Possible IndigoDrop/Cobalt Strike Download rev 3 2024-04-12
suricata ET MALWARE Cobalt Strike Beacon Activity rev 3 2024-04-04
suricata ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M3 rev 4 2024-04-04
suricata ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M5 rev 3 2024-04-04
suricata ET MALWARE Cobalt Strike Beacon Observed rev 5 2024-04-04
suricata ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M6 rev 3 2024-04-03
suricata ET HUNTING Suspicious Empty SSL Certificate - Observed in Cobalt Strike rev 7 2024-03-27
suricata ET MALWARE Cobalt Strike Related Domain in DNS Lookup rev 2 2024-03-26
sigma Potential CobaltStrike Service Installations - Registry test 2024-03-25
suricata ET MALWARE Observed Cobalt Strike Stager Domain in DNS Query rev 2 2024-03-24
sigma HackTool - CobaltStrike Malleable Profile Patterns - Proxy test 2024-02-15
sigma Meterpreter or Cobalt Strike Getsystem Service Installation - System test 2023-11-15
sigma Meterpreter or Cobalt Strike Getsystem Service Installation - Security test 2023-11-15
sigma Lace Tempest Cobalt Strike Download test 2023-11-09
snort ET TROJAN Cobalt Strike Beacon Activity rev 3 2023-09-12
suricata ET MALWARE Cobalt Strike Domain in DNS Lookup rev 1 2023-06-08
snort ET TROJAN Cobalt Strike Domain in DNS Lookup rev 1 2023-06-08
sigma HackTool - Potential CobaltStrike Process Injection test 2023-05-05
sigma Potential CobaltStrike Process Patterns test 2023-03-29
sigma Potential Meterpreter/CobaltStrike Activity test 2023-02-05
sigma Operator Bloopers Cobalt Strike Commands test 2023-01-30
sigma Operator Bloopers Cobalt Strike Modules test 2023-01-30
sigma Suspicious Cobalt Strike DNS Beaconing - Sysmon test 2023-01-16
sigma Suspicious Cobalt Strike DNS Beaconing - DNS Client test 2023-01-16
sigma Bad Opsec Powershell Code Artifacts test 2022-12-25
sigma CobaltStrike Service Installations - System test 2022-11-27
sigma CobaltStrike Service Installations - Security test 2022-11-27
suricata ET MALWARE Cobalt Strike Related Domain in DNS Lookup rev 1 2022-10-25
snort ET TROJAN Cobalt Strike Related Domain in DNS Lookup rev 1 2022-10-25
suricata ET MALWARE Cobalt Strike Related Domain in DNS Lookup rev 1 2022-10-25
snort ET TROJAN Cobalt Strike Related Domain in DNS Lookup rev 1 2022-10-25
sigma Default Cobalt Strike Certificate test 2022-10-09
sigma Cobalt Strike DNS Beaconing test 2022-10-09
sigma CobaltStrike Load by Rundll32 test 2022-09-16
snort ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile M6 rev 1 2022-06-29
snort ET TROJAN Suspected Cobalt Strike Beacon User-Agent String rev 1 2022-06-15
suricata ET MALWARE Suspected Cobalt Strike Beacon User-Agent String rev 1 2022-06-15
snort ET TROJAN [eSentire] Cobalt Strike Beacon rev 3 2022-05-03
snort ET INFO Suspicious Empty SSL Certificate - Observed in Cobalt Strike rev 3 2022-03-24
snort ET TROJAN Cobalt Strike Related Domain in DNS Lookup rev 2 2021-12-14
suricata ET MALWARE NOBELIUM Cobalt Strike CnC Domain in DNS Lookup rev 1 2021-12-07
snort ET TROJAN NOBELIUM - Cobalt Strike Malleable Profile M1 rev 2 2021-12-07
snort ET TROJAN NOBELIUM Cobalt Strike CnC Domain in DNS Lookup rev 2 2021-12-07
snort ET TROJAN NOBELIUM Cobalt Strike CnC Domain in DNS Lookup rev 2 2021-12-07
suricata ET MALWARE NOBELIUM Cobalt Strike CnC Domain in DNS Lookup rev 1 2021-12-07
snort ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile M5 rev 2 2021-11-15
snort ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile M2 rev 3 2021-08-05
suricata ET JA3 Hash - Possible Cobalt Strike Server rev 1 2021-07-23
suricata ET JA3 Hash - Possible Cobalt Strike Server rev 1 2021-07-23
suricata ET JA3 Hash - Possible Cobalt Strike Server rev 1 2021-06-22
suricata ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response rev 1 2021-05-21
snort ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile M3 rev 2 2021-05-21
snort ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile Response rev 1 2021-05-21
suricata ET MALWARE Cobalt Strike Stager Time Check M2 rev 1 2021-04-20
snort ET TROJAN Cobalt Strike Stager Time Check M1 rev 2 2021-04-20
snort ET TROJAN Cobalt Strike Stager Time Check M2 rev 1 2021-04-20
suricata ET MALWARE Cobalt Strike Stager Time Check M1 rev 2 2021-04-20
snort ET TROJAN Cobalt Strike Beacon Activity rev 2 2021-03-22
snort ET TROJAN Possible IndigoDrop/Cobalt Strike Download rev 2 2020-06-26
snort ET TROJAN Observed Cobalt Strike Stager Domain in DNS Query rev 2 2020-05-06
snort ET TROJAN [PTsecurity] Possible Cobalt Strike payload rev 3 2019-04-19
snort ET TROJAN Cobalt Strike Exfiltration rev 2 2018-07-03
snort ET TROJAN Cobalt Strike Malleable C2 Webbug Profile rev 3 2018-06-14
snort ET TROJAN Cobalt Strike Malleable C2 OCSP Profile rev 1 2017-05-15
snort ET TROJAN Cobalt Strike Malleable C2 Amazon Profile rev 1 2017-04-28
snort ET TROJAN Cobalt Strike Beacon Observed rev 1 2015-09-09