CobaltStrike

Named by 2 kept items in this workspace.

Search every workspace for CobaltStrike. It matches the name as written, so it can find other things that share it.

The items that name it 2

The First 24 Hours: What Happens When Ransomware Lands
writeup2026-10-02It is written here as Cobalt Strike.
Attacker tooling detected and removed from 11 critical servers within 24 hours in a Colorado engagement described by UnderDefense
Sigma r2026-07-01 — 20 new detection rules
repo
C2 framework; existing named pipe pattern regex rule tightened in this release

All threat actors in this workspace.