Trellix Insights: Daily C2: CobaltStrike

Technical Articles ID: KB94406
Last Modified: 2022-09-06 13:59:36 Etc/GMT

Environment

IMPORTANT: This Knowledge Base article discusses a specific threat that is being automatically tracked by Trellix Insights technology. The content is intended for use by Trellix Insights users, but is provided for general knowledge to all customers. Contact us for more information about Trellix Insights.

Summary

Description of Campaign
This event is a daily update of identified Cobalt Strike Command and Control (C2) infrastructure. Our Threat Research team advises Insights users to block traffic going to and from the identified C2 servers. We will continue to monitor and update the CobaltStrike C2 event and disseminate information that is deemed appropriate regarding CobaltStrike.

Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.

The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.
Source: Malpedia.

How to use this article:

Scroll down and review the Product Countermeasures section of this article. Consider implementing them if they are not already in place.
Review the following articles:
- KB87843 - Dynamic Application Containment rules and best practices
- KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event

Campaign IOC

Type	Value
IP-DST	185.22.153.46
IP-DST	5.2.67.241
IP-DST	5.2.67.241
IP-DST	218.253.251.89
IP-DST	193.29.58.173
IP-DST	185.213.26.160
IP-DST	78.129.165.207
IP-DST	185.162.235.111
IP-DST	88.119.175.102
IP-DST	88.119.175.102
IP-DST	185.141.24.102
IP-DST	194.15.112.240
IP-DST	194.15.112.240
IP-DST	185.201.47.157
IP-DST	195.123.221.142
IP-DST	188.225.85.203
IP-DST	45.132.12.231
IP-DST	154.220.3.226
IP-DST	45.61.139.89
IP-DST	5.2.64.194
IP-DST	161.35.160.39
IP-DST	185.14.30.217
IP-DST	5.39.221.60
IP-DST	194.76.224.99
IP-DST	194.76.224.99
IP-DST	212.183.37.229
IP-DST	192.184.35.203
IP-DST	45.153.184.167
IP-DST	74.121.191.2
IP-DST	159.138.147.229
IP-DST	45.76.48.40
IP-DST	45.76.48.40
IP-DST	74.121.191.2
IP-DST	74.121.191.2
IP-DST	185.213.26.160
IP-DST	79.141.160.185
IP-DST	185.20.186.108
IP-DST	3.135.197.204
IP-DST	35.173.48.181
IP-DST	108.166.207.133
IP-DST	34.203.235.59
IP-DST	162.251.120.110
IP-DST	162.251.120.110
IP-DST	18.180.199.201
IP-DST	103.149.27.116
IP-DST	185.203.116.130
IP-DST	185.162.235.111
IP-DST	185.162.235.111
IP-DST	38.135.104.132
IP-DST	46.166.173.78
IP-DST	31.14.41.212
IP-DST	213.217.0.216
IP-DST	213.217.0.217
IP-DST	185.106.123.105
IP-DST	38.135.104.133
IP-DST	176.121.14.249
IP-DST	101.32.194.142
IP-DST	3.83.145.77
IP-DST	3.83.145.77
IP-DST	39.109.116.2
IP-DST	194.165.16.60
IP-DST	172.98.192.91
IP-DST	31.44.184.73
IP-DST	45.146.165.140
IP-DST	45.146.165.140
IP-DST	52.220.162.114
IP-DST	104.200.67.168
IP-DST	23.163.0.12
IP-DST	192.3.81.214
IP-DST	212.183.37.229
IP-DST	178.128.233.247
IP-DST	145.249.107.229
IP-DST	155.94.194.25
IP-DST	35.203.173.196
IP-DST	5.34.180.137
IP-DST	185.212.47.17
IP-DST	185.212.47.17
IP-DST	185.158.249.123
IP-DST	159.138.147.229
IP-DST	54.179.160.197
IP-DST	104.243.46.74
IP-DST	87.120.8.67
IP-DST	87.120.8.67
IP-DST	104.238.205.44
IP-DST	185.153.196.130
IP-DST	185.118.166.66
IP-DST	185.118.166.66
IP-DST	107.181.187.116
IP-DST	128.199.201.106
IP-DST	149.28.133.184
IP-DST	213.217.0.217
IP-DST	185.244.150.146
IP-DST	109.201.142.39
IP-DST	46.101.47.102
IP-DST	93.179.127.70
IP-DST	104.41.130.190
IP-DST	107.148.129.189
IP-DST	139.60.161.99
IP-DST	149.28.133.184
IP-DST	149.28.133.184
IP-DST	45.32.61.165
IP-DST	122.10.161.42
IP-DST	185.243.112.18
IP-DST	31.44.184.100
IP-DST	31.44.184.100
IP-DST	31.44.184.100
IP-DST	54.226.33.66
IP-DST	185.106.123.110
IP-DST	104.238.205.44
IP-DST	45.147.200.110
IP-DST	47.90.202.152
IP-DST	47.75.123.100
IP-DST	5.34.181.12
IP-DST	5.34.181.12
IP-DST	5.34.181.12
IP-DST	192.3.81.214
IP-DST	3.135.197.204
IP-DST	5.180.76.245
IP-DST	5.180.76.245
IP-DST	100.24.56.227
IP-DST	52.220.162.114
IP-DST	52.220.162.114
IP-DST	137.59.16.168
IP-DST	161.35.160.39
IP-DST	91.229.23.63
IP-DST	103.153.100.248
IP-DST	194.110.220.69
IP-DST	194.110.220.69
IP-DST	213.217.0.217
IP-DST	45.90.57.203
IP-DST	45.90.57.203
IP-DST	206.189.233.82
IP-DST	45.195.153.149
IP-DST	47.57.125.197
IP-DST	47.57.125.197
IP-DST	77.123.155.74
IP-DST	77.123.155.74
IP-DST	185.141.24.102
IP-DST	154.220.3.226
IP-DST	155.138.245.98
IP-DST	155.138.245.98
IP-DST	185.219.221.184
IP-DST	193.27.229.34
IP-DST	193.27.229.34
IP-DST	54.93.165.205
IP-DST	5.252.179.218
IP-DST	150.109.123.86
IP-DST	135.125.128.100
IP-DST	135.125.128.100
IP-DST	135.125.128.100
IP-DST	94.103.94.203
IP-DST	145.249.106.137
IP-DST	39.109.116.2
IP-DST	39.109.116.2
IP-DST	103.96.151.147
IP-DST	20.56.147.8
IP-DST	5.199.162.30
IP-DST	72.11.142.240
IP-DST	101.36.108.242
IP-DST	101.36.108.242
IP-DST	165.232.164.198
IP-DST	35.201.213.225
IP-DST	185.162.235.54
IP-DST	134.209.117.238
IP-DST	45.76.244.163
IP-DST	178.162.199.36
IP-DST	46.101.58.213
IP-DST	135.181.139.6
IP-DST	80.92.204.13
IP-DST	80.92.204.13
IP-DST	80.92.204.13
IP-DST	18.216.165.192
IP-DST	45.76.202.203
IP-DST	5.199.162.115
IP-DST	194.36.191.12
IP-DST	20.56.147.8
IP-DST	104.131.105.89
IP-DST	167.71.141.53
IP-DST	185.232.52.44
IP-DST	185.232.52.44
IP-DST	5.189.144.20
IP-DST	5.189.144.20
IP-DST	188.34.183.81
IP-DST	108.178.50.74
IP-DST	108.178.50.74
IP-DST	147.139.4.69
IP-DST	185.158.249.232
IP-DST	213.217.0.218
IP-DST	5.183.8.99
IP-DST	5.183.8.99
IP-DST	38.135.104.131
IP-DST	38.135.104.134
IP-DST	185.173.92.10
IP-DST	35.224.197.52
IP-DST	185.150.117.35
IP-DST	138.197.166.63
IP-DST	138.197.166.63
IP-DST	185.82.202.123
IP-DST	40.76.215.67
IP-DST	66.42.59.10
IP-DST	45.146.165.140
IP-DST	45.146.165.140
IP-DST	47.57.125.197
IP-DST	23.106.160.62
IP-DST	213.217.0.218
IP-DST	213.217.0.218
IP-DST	15.222.65.205
URL	185.22.153.46/fwlink
URL	5.2.67.241/load
URL	5.2.67.241/g.pixel
URL	218.253.251.89/activity
URL	193.29.58.173/visit.jsnerotimethod.com/dpixel
URL	185.213.26.160/watch
URL	78.129.165.207/ptj
URL	185.162.235.111/updates.rss
URL	update.webguardsecurity.xyz/match88.119.175.102/ca
URL	update.webguardsecurity.xyz/cm88.119.175.102/__utm.gif
URL	radane.net/j.ad
URL	194.15.112.240/cm
URL	194.15.112.240/en_US/all.js
URL	185.201.47.157/zC
URL	195.123.221.142/ca
URL	188.225.85.203/en_US/all.js
URL	45.132.12.231/j.ad
URL	154.220.3.226/g.pixel
URL	45.61.139.89/pixel.gif
URL	5.2.64.194/cm
URL	161.35.160.39/dot.gif
URL	185.14.30.217/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
URL	5.39.221.60/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
URL	194.76.224.99/activity
URL	194.76.224.99/ca
URL	212.183.37.229/en_US/all.js
URL	ec2-3-137-140-194.us-east-2.compute.amazonaws.com/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
URL	45.153.184.167/__utm.gif
URL	45.63.69.93/activity
URL	159.138.147.229/visit.js
URL	45.76.48.40/visit.js
URL	45.76.48.40/visit.js
URL	51.81.142.72/fwlink
URL	51.81.142.72/ga.js
URL	185.213.26.160/watch
URL	79.141.160.185/c/msdownload/update/others/2020/10/29136388_
URL	185.20.186.108/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
URL	scripts.diaplad.com/ptj
URL	synergiedental.com/safebrowsing/rd/CltOb12nLW1IbHehcmUtd2hUdmFzEBAY7-0KIOkUDC7h2
URL	108.166.207.133/pixel
URL	sitehealthcheck.org/oscp/
URL	162.251.120.110/ca
URL	162.251.120.110/g.pixel
URL	18.180.199.201/ca
URL	103.149.27.116/dpixel
URL	185.203.116.130/dot.gif
URL	185.162.235.111/updates.rss
URL	185.162.235.111/push
URL	38.135.104.132/ga.js
URL	46.166.173.78/pixel
URL	31.14.41.215/cx31.14.41.214/pixel31.14.41.213/__utm.gif31.14.41.212/g.pixel
URL	213.217.0.216/load
URL	213.217.0.217/fwlink
URL	dain22.net/userid=
URL	38.135.104.132/en_US/all.js
URL	176.121.14.249/owa/
URL	service-p15vjtxk-1256858750.gz.apigw.tencentcs.com/api/getit
URL	d18apeaghqw12n.cloudfront.net/w/api.php
URL	d18apeaghqw12n.cloudfront.net/w/api.php
URL	59.151.40.186/g.pixel120.132.70.253/ga.js
URL	194.165.16.60/push
URL	172.98.192.91/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
URL	31.44.184.73/en_US/all.js
URL	45.146.165.140/ga.js
URL	45.146.165.140/IE9CompatViewList.xml
URL	52.220.162.114/CWoNaJLBo/VTNeWw11212/
URL	104.200.67.168/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
URL	ec2-3-101-135-7.us-west-1.compute.amazonaws.com/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
URL	139.199.185.41/en_US/all.js
URL	212.183.37.229/ptj
URL	178.128.233.247/pixel
URL	145.249.107.229/updates.rss
URL	155.94.194.25/match
URL	www.unwomen.org/jquery-3.3.1.min.jswww.prodibi.com/jquery-3.3.1.min.jswww.oriental-residence.com/jquery-3.3.1.min.js
URL	5.34.180.137/load
URL	185.212.47.17/cx
URL	185.212.47.17/ga.js
URL	185.158.249.123/match
URL	159.138.147.229/visit.js
URL	54.179.160.197/dot.gif
URL	104.243.46.74/push
URL	18.217.64.173/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
URL	18.217.64.173/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
URL	syscx.com/dot.gif
URL	185.153.196.130/ga.js
URL	185.118.166.66/IE9CompatViewList.xml
URL	cs.colunm.tk/updates.rss
URL	107.181.187.116/pixel.gif
URL	10.10.14.2/visit.js
URL	149.28.133.184/match
URL	213.217.0.217/fwlink
URL	savann.org/visit.js
URL	109.201.142.39/j.ad
URL	base-js.azureedge.net/sites/p/b93/sys/themes/standard-solitudenavy-ltr.css
URL	93.179.127.70/en_US/all.js
URL	104.41.130.190/assets/site-d3c48f1b58ea95d9efb184fd4592b411.css
URL	107.148.129.189/ca
URL	139.60.161.99/dpixel
URL	149.28.133.184/match
URL	149.28.133.184/visit.js
URL	45.32.61.165/ga.js
URL	122.10.161.42/ga.js
URL	threehunders.com/ca185.243.112.18/cm
URL	31.44.184.100/ga.js
URL	31.44.184.100/load
URL	31.44.184.100/cx
URL	cs.yourintrinsichealth.com/match
URL	wellser.org/userid=
URL	syscx.com/dot.gif
URL	ssl363648.cloudflaressl.com/dpixel
URL	47.90.202.152/push
URL	news.itamarty.com/dpixel
URL	5.34.181.12/match
URL	5.34.181.12/ca
URL	5.34.181.12/visit.js
URL	139.199.185.41/en_US/all.js
URL	scripts.diaplad.com/visit.js
URL	ocserv.faeinfo.me/updates.rss
URL	5.180.76.245/match
URL	100.24.56.227/bing
URL	52.220.162.114/CWoNaJLBo/VTNeWw11212/
URL	52.220.162.114/CWoNaJLBo/VTNeWw11212/
URL	137.59.16.168/j.ad
URL	161.35.160.39/IE9CompatViewList.xml
URL	146.0.72.91/j.ad91.229.23.63/updates.rss
URL	61.168.100.179/api/getit
URL	194.110.220.69/RELEASE_NOTES
URL	194.110.220.69/RELEASE_NOTES
URL	213.217.0.217/load
URL	45.90.57.203/IE9CompatViewList.xml
URL	45.90.57.203/updates.rss
URL	206.189.233.82/safebrowsing/rd/CltOb12nLW1IbHehcmUtd2hUdmFzEBAY7-0KIOkUDC7h2
URL	404web.me/api/getit
URL	47.57.125.197/pixel
URL	47.57.125.197/ptj
URL	77.123.155.74/owa/
URL	77.123.155.74/owa/
URL	radane.net/j.ad
URL	154.220.3.226/g.pixel
URL	155.138.227.139/_/scs/mail-static/_/js/
URL	155.138.227.139/_/scs/mail-static/_/js/
URL	185.219.221.184/activity
URL	193.27.229.34/activity
URL	193.27.229.34/cx
URL	54.93.165.205/IE9CompatViewList.xml
URL	5.252.179.218/ptj
URL	service-dlijjgbw-1304664184.hk.apigw.tencentcs.com/api/getit
URL	135.125.128.100/ga.js
URL	135.125.128.100/cm
URL	135.125.128.100/fwlink
URL	94.103.94.203/match
URL	145.249.106.137/fwlink
URL	59.151.40.186/g.pixel120.132.70.253/ga.js
URL	39.109.116.2/pixel.gif
URL	103.96.151.147/FC001/JOHN
URL	20.56.147.8/ptj
URL	5.199.162.30/dpixel
URL	covid.ocitnetad.com/fwlink
URL	172.19.178.93/image/
URL	172.19.178.93/image/
URL	cdnetworks.viewdns.net/owa/
URL	35.201.213.225/__utm.gif
URL	185.162.235.54/j.ad
URL	jude.saintjameschurch.org/Video
URL	wpslaunch.info/match
URL	178.162.199.36/dot.gif
URL	46.101.58.213/oscp/
URL	ssrolt.global.ssl.fastly.net/cx
URL	update.securessl.xyz/fwlink80.92.204.13/updates.rss
URL	update.securessl.xyz/g.pixel80.92.204.13/load
URL	update.securessl.xyz/__utm.gif80.92.204.13/g.pixel
URL	scripts.beyondthecity.ca/updates.rss
URL	45.76.202.203/en_US/all.js
URL	5.199.162.115/dot.gif
URL	kasaa.net/userid=
URL	20.56.147.8/en_US/all.js
URL	167.71.141.53/cm
URL	185.232.52.44/push
URL	185.232.52.44/j.ad
URL	5.189.144.20/bank/ziraat/google
URL	5.189.144.20/bank/ziraat/google
URL	188.34.183.81/fwlink
URL	45.176.188.137/ca
URL	74.121.191.2/ca
URL	147.139.4.69/cx
URL	185.158.249.232/g.pixel
URL	213.217.0.218/IE9CompatViewList.xml
URL	mortaladmin.com/dpixel
URL	mortaladmin.com/dpixel
URL	38.135.104.132/pixel.gif
URL	38.135.104.132/pixel.gif
URL	185.173.92.10/pixel.gif
URL	35.224.197.52/__utm.gif
URL	185.150.117.35/activity
URL	138.197.166.63/__utm.gif
URL	138.197.166.63/en_US/all.js
URL	185.82.202.123/j.ad
URL	scangroup.azurewebsites.net/s3c/HttpT1
URL	redteam.laststanding4me.xyz/match
URL	45.146.165.140/ga.js
URL	45.146.165.140/IE9CompatViewList.xml
URL	47.57.125.197/pixel
URL	rockwish.com/us/ky/louisville/312-s-fourth-st.html199.127.61.194/us/ky/louisville/312-s-fourth-st.html
URL	213.217.0.218/IE9CompatViewList.xml
URL	213.217.0.218/IE9CompatViewList.xml
URL	msazure-api-us.arsvmcloud.com/jquery-3.3.1.min.jsmsazure-api-eu.arsvmcloud.com/jquery-3.3.1.min.js

Minimum set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Endpoint Security - Advanced Threat Protection:

Rule ID: 5 Use GTI URL reputation to identify trusted or malicious processes

Affected Products

Trellix insights

Knowledge Center

Trellix Insights: Daily C2: CobaltStrike

Environment

Summary

Affected Products

Title

Title

Knowledge Center

Trellix Insights: Daily C2: CobaltStrike

Environment

Summary

Affected Products

Choose your region

Title

Title