IOCs by window
0
IOCs tagged #CobaltStrike
0
IOCs tagged #CobaltStrike
1
IOCs tagged #CobaltStrike
126
IOCs tagged #CobaltStrike
Counts as of 2026-10-28. Regenerated daily.
About #CobaltStrike
- Type: Commercial adversary simulation framework.
- Parts: Team Server and Beacon implant. C2 over HTTP, HTTPS, DNS, named pipe.
- Vendor: Fortra (formerly Strategic Cyber LLC).
- Abuse: Pirated and cracked copies dominate in the wild.
- Used by: APTs, ransomware affiliates, initial access brokers.
- Detection: Stager URIs, JA3/JA4, watermarks, named pipes. YARA for known stomped DLLs.
- References: MITRE ATT&CK S0154 · Malpedia · Vendor (Fortra)
Recent IOCs tagged #CobaltStrike
Latest 1 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/cobaltstrike.
| Date | Type | Value | Source |
|---|---|---|---|
| ip |
Low volume this month. Year total: 126. Older data: api.tweetfeed.live/v1/year (all tags, filter for #CobaltStrike).
Related tags
Frequently asked questions
What is Cobalt Strike?
A commercial red-team framework from Fortra, with a Team Server and a Beacon implant. Pirated copies are often used by APTs, ransomware affiliates and initial access brokers.
Is Cobalt Strike legal?
A licensed copy used for authorised red-team work is legal, cracked copies are not. We make no claim about the license of any listed IP, domain or hash.
How is this list updated?
The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.
What is the license? Can I use this commercially?
Yes. All IOC data, including this Cobalt Strike subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.
License
Cobalt Strike IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.