Threat: Cobalt Strike | Detection.FYI

Default Cobalt Strike Team Server Certificate

Sep 19, 2026 · Tactic: Command and Control Threat: Cobalt Strike Use Case: Threat Detection Domain: Endpoint Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: Custom Query (KQL) Domain: Network Data Source: Network Packet Capture ·
Share on:

This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1). See the References section for additional information on module configuration.

Read More