Red Team Archives - Page 4 of 9 - Cobalt Strike Research and Development

Red Team Posted on February 17, 2016 (May 3, 2022)

There are a lot of people who talk about threat emulation. Use our super-duper-elitesy-neatsy-malware to emulate these tactics in your network. I say stuff like

Red Team Posted on January 13, 2016 (May 3, 2022)

Real-Time Feed of Red Team Activity

There are several research projects to collect raw data from red team activity, process this data, and try to turn it into information. In this

Red Team Posted on December 16, 2015 (May 3, 2022)

Windows Access Tokens and Alternate Credentials

I’d like to call your attention to the humble runas.exe program on Windows. This program allows a Windows user to spawn another program with another

Red Team Posted on December 9, 2015 (May 3, 2022)

Post-Exploitation Only (Not Really)

During a recent conversation, a friend had mentioned that they saw Cobalt Strike as a post-exploitation only tool. This strikes me as a little odd.

Red Team Posted on November 18, 2015 (May 3, 2022)

Flying a Cylon Raider

In Season 1, Episode 5 of Battlestar Galactica, Lieutenant Kara Thrace finds herself marooned on a barren planet with a crashed Cylon Raider. To get

Red Team Posted on October 21, 2015 (May 3, 2022)

Migrating Your Infrastructure

I’ve written about infrastructure for red team operations before. Infrastructure are the servers, domains, and other assets that support your ongoing operation against a target

Red Team Posted on September 30, 2015 (April 26, 2023)

Advanced Threat Tactics – Course and Notes

The release of Cobalt Strike 3.0 also saw the release of Advanced Threat Tactics, a nine-part course on red team operations and adversary simulations. This

Red Team Posted on September 9, 2015 (May 3, 2022)

Rethinking Reporting for Red Team Operations

Cobalt Strike 3.0 is coming in a few weeks. This upcoming release is the result of a large engineering effort that paralleled my existing efforts

Red Team Posted on August 3, 2015 (September 28, 2022)

Raphael’s Magic Quadrant

BlackHat is about to start in a few days. I think this is an appropriate time to share a non-technical, business only post. There is

Red Team Posted on July 22, 2015 (May 3, 2022)

WinRM is my Remote Access Tool

One of my favorite blog posts last year was Adversary Tricks and Treats from CrowdStrike. In this post, CrowdStrike details the tradecraft of an actor

Blogs filtered by Red Team