Cobalt Strike and Tradecraft

What it is

A defender's-eye breakdown of five built-in Cobalt Strike Beacon commands — shell, pth, run, powershell, and powerpick — documenting the exact process-creation and logon artifacts each leaves in a Sysmon + Winlogbeat + ELK pipeline. It is explicitly a walkthrough of Cobalt Strike's own op-sec guidance from a detection standpoint, biased toward "somewhat mature" environments, and is billed as part one of a two-part series.

How it works

Each command produces a distinct, signature-able artifact chain:

• shell → cmd.exe /c spawned under Beacon, which spawns the target (e.g. whoami.exe); conhost.exe is launched alongside cmd.exe.
• pth → the profile-defined spawnto process (author's is dllhost.exe) is created as a sacrificial child, mimikatz builds a new logon session (Event ID 4672), the account logs on (Event ID 4624), then cmd.exe is spawned under dllhost.exe with a string passed via named pipe. The parent's logon session then shows the impersonated user.
• run / execute → calls the target executable directly (no cmd.exe), still spawning conhost.exe; execute returns no output.
• powershell → spawns powershell.exe (parent PID adjustable via the ppid command) with base64-encoded command and -exec bypass.
• powerpick → fork-and-run under the spawnto process; powerpick whoami yields three processes: dllhost.exe, conhost.exe, whoami.exe, with no powershell.exe.

The recurring tell across shell/pth/run/powerpick is the conhost.exe invocation with arguments 0xffffffff -ForceV1 (a console session identifier), which the author notes isn't malicious itself but is a common identifier for these commands.

flowchart TD
    B[Beacon] -->|shell| C1[cmd.exe /c → target]
    B -->|pth| D[dllhost.exe spawnto]
    D --> L1[4672 logon session]
    L1 --> L2[4624 logon]
    L2 --> C2[cmd.exe via named pipe]
    B -->|run| R[target.exe direct]
    B -->|powershell| P[powershell.exe -exec bypass + base64]
    B -->|powerpick| PP[dllhost.exe → whoami.exe]
    C1 & C2 & R & PP --> CH[conhost.exe 0xffffffff -ForceV1]

What to do

There are no patches or vendor commands here — this is detection-engineering source material. Concrete hunt signals it hands you:

• Alert on conhost.exe with args 0xffffffff -ForceV1 correlated with cmd.exe /c.
• Flag base64-encoded PowerShell with -exec bypass (rare in legitimate use).
• For pass-the-hash, look for the ordered sequence: spawnto process → 4672 → 4624 → child cmd.exe, where the parent process's logon-session user changes.
• For fork-and-run, the spawnto (default here dllhost.exe) parenting an unexpected child like whoami.exe.

Caveats

The author states "bad op-sec" is subjective and environment-dependent — none of this triggers in an env with no detection. The lab is deliberately simple (basic ELK/Sysmon, no "advanced" detections), the spawnto and ppid are attacker-configurable (so dllhost.exe is just this profile's default), and the article is incomplete — it cuts off mid-sentence in the powerpick section and does not cover all commands.