Cobalt Strike
Named by 19 kept items in this workspace.
14 items name it under tools and 5 under classification.technologies.
Search every workspace for Cobalt Strike. It matches the name as written, so it can find other things that share it.
The items that name it 19
Pentesting and red-teaming platform historically used by espionage and financially motivated actors
C2 framework used in the ARTOC labs to build C2 infrastructure; the labs provide a fully licensed copy, and the course covers customizing its malleable profiles and how they affect detection
Off-the-shelf offensive tooling historically identified by defenders via signatures/behaviors.
Payload delivered via the malicious Jackson lookalike package (offensive/post-exploitation tool used maliciously)
C2 framework (event ingestion)
C2 framework whose profiles are tuned by the c2-operator agent
C2 framework; most public BOF collections on GitHub are designed for it, and Conquest's bof_pack function is modeled after Cobalt Strike's Aggressor Script function of the same name
Dual-use penetration testing framework previously misused by threat actors, per Huntress 2025 Cyber Threat Report
Commercial adversary simulation/C2 framework; its Beacon payload and Elevate Kit were used by threat actors for privilege escalation
Post-exploitation framework; course covers hunting .NET loads via execute-assembly
Command and control (C2) framework used throughout the course and exam labs; full license instance provided in labs
Beacon payload delivered via Intune PowerShell script to gain on-premise foothold
Adversary simulation/red team command-and-control framework whose built-in commands (shell, pth, run, powershell, powerpick, spawnas) and op-sec implications are analyzed
C2 framework used to generate payloads/shellcode and run 'get privs' to check integrity level; also has Aggressor scripts to automate UAC bypasses
All technologies in this workspace.