Cobalt Strike Advanced complete: Red Team Command & Control production-ready, Beacon exploitation tutorial, C2 evasion resolved, Team Server deployment. Encyclopedic reference for adversary simulation and penetration testing
When To Use
Ideal
- Red team operations requiring multi-stage payload delivery with Cobalt Strike Beacon across firewalled networks - Advanced command and control simulations with Cobalt Strike Team Server for authorized penetration testing engagements - Post-exploitation workflows using Cobalt Strike's lateral movement and privilege escalation in production infrastructure assessments
Avoid
- Unauthorized network access using Cobalt Strike C2 beacons (illegal without explicit written permission) - Bypassing security systems outside authorized penetration testing scope with Cobalt Strike evasion techniques - Using Cobalt Strike advanced persistence methods without documented client authorization and ROE (rules of engagement)
Core Concepts
Red Team Beacon: C2 Agent Architecture
Cobalt Strike Beacon serves as the command and control agent, running on compromised targets with multiple communication channels (HTTP/HTTPS/DNS/SMB). Supports staged and stageless payloads. See HTTP Beacon Communication examples below
Malleable Command & Control: Profile Customization
Malleable C2 profiles define Beacon behavior, communication patterns, indicators of compromise (IOCs), and payload obfuscation. Critical for OPSEC and evading endpoint detection and response (EDR) solutions
Lateral Movement: Beacon Propagation
Advanced lateral movement techniques including pass-the-hash, Kerberoasting, and token impersonation using Cobalt Strike's beacon command set for privilege escalation and network expansion
Team Server: Multi-Operator Collaboration
Cobalt Strike Team Server enables multiple red teamers to control beacons simultaneously, manage listeners, share logs, and coordinate post-exploitation activities in real-time
Beacon Staging: Multi-Stage Payload Delivery
Staged payloads deliver minimal first-stage stubs that fetch full Beacon from Team Server. Reduces initial footprint and bypasses payload size restrictions in various exploitation vectors
More Content: https://yourcheatsheet.org/cheatsheets/cobalt-strike-advanced