Default Cobalt Strike Team Server Certificateedit

This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. If using Filebeat, this rule requires the Suricata or Zeek modules. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1) - see the Reference section for additional information on module configuration.

Rule type: query

Rule indices:

  • filebeat-*
  • packetbeat-*

Severity: critical

Risk score: 100

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100



  • Command and Control
  • Post-Execution
  • Threat Detection, Prevention and Hunting
  • Elastic
  • Network

Version: 2 (version history)

Added (Elastic Stack release): 7.11.0

Last modified (Elastic Stack release): 7.11.2

Rule authors: Elastic

Rule license: Elastic License

Investigation guideedit

While Cobalt Strike is intended to be used for penetration tests and IR training, it is frequently used by actual threat actors (TA) such as APT19, APT29, APT32, APT41, FIN6, DarkHydrus, CopyKittens, Cobalt Group, Leviathan, and many other unnamed criminal TAs. This rule uses high-confidence atomic indicators, alerts should be investigated rapidly.

Rule queryedit

event.category:(network or network_traffic) and
(tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83 or
tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C or tls.s

Threat mappingedit


Rule version historyedit

Version 2 (7.11.2 release)
  • Formatting only