Pith. sign in

REVIEW 3 major objections 5 minor 74 references

Striking Back At Cobalt: Using Network Traffic Metadata To Detect Cobalt Strike Masquerading Command and Control Channels

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read NetFlow metadata alone can spot masquerading Cobalt Strike C2 traffic, with adaptive per-domain models reaching F1 scores up to 1.0.

desk verdict A solid lab study of a sensible adaptive per-domain metadata-based C2 detector, but the real-world HTTPS evaluation is circular and the abstract overstates what is shown. read the letter →

arxiv 2506.08922 v1 pith:TBJUIZ3P submitted 2025-06-10 cs.CR

Clément Parssegny , Johan Mazel , Olivier Levillain , Pierre Chifflier This is my paper
classification cs.CR
keywords CobaltStrikecommandandcontroldetectionNetFlowmetadataRandomForestmalleableC2profilesmasqueradingtrafficencryptednetworkclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a supervised machine-learning model using only standard NetFlow v5/v9 flow metadata can detect Cobalt Strike command-and-control (C2) traffic even when the traffic is configured to mimic benign websites and is encrypted with TLS. The authors build random-forest classifiers for HTTP, HTTPS, and DNS channels, with separate models for each mimicked domain such as Amazon, jQuery, and Smashburger. When the imitated domain is identifiable from the Host/SNI fields or an IP prefix, the method selects the matching domain-specific model; otherwise it falls back to generic models. Across the generated datasets the mean F1 score ranges from 0.78 to 1.0 at a 95% confidence level, and on real-world traces the domain-matched HTTP case reaches F1 of 0.99. The intended payoff is a detection approach that works in production settings because it relies on widely available metadata and explainable models rather than deep packet inspection.

What carries the argument

The load-bearing mechanism is an adaptive model-selection architecture over a set of profile-specific Random Forest classifiers. Each classifier is trained on NetFlow v5 or v9 metadata from one malleable C2 profile together with benign traffic that is either generic or specific to the mimicked domain. At classification time the method inspects only the flow's protocol and the domain name available in the Host header, SNI, or the destination IP's prefix; if the domain matches a known mimicked service, the corresponding model is applied, otherwise a generic model is used. The Random Forest is trained with stratified 10-fold cross-validation and grid-searched hyperparameters, and feature importance is measured via Mean Decrease in Impurity, which the authors use to explain why C2 flows are separable, chiefly through payload-size extremes and asymmetries between sent and received bytes.

What would settle it

Test a model trained on one Amazon-mimicking profile against traffic from another Amazon-mimicking profile in the same TLSH cluster; if the F1 falls well below the reported near-perfect scores, the claim that domain-matched models generalize across profiles within the mimicked domain is falsified.

Watch

Extended reading notes

Core claim

The central discovery is that Cobalt Strike's masquerading C2 traffic leaves detectable signatures in simple flow statistics, and that model selection based on the observed domain materially improves detection. Using only NetFlow v5 and v9 features (packet and byte counts, sizes, durations, TCP flags, protocol and service information) plus two symmetric ratios, a Random Forest distinguishes malicious from benign flows with mean F1 between 0.78 and 1.0 across protocols and profiles. When the mimicked website can be recognized, the domain-specific model outperforms a generic detector, yielding tighter F1 distributions and in several cases reaching a perfect score. On HTTPS traces from real-world attacks where the profile is unknown, performance degrades but remains comparable to prior methods, whereas the one trace whose jQuery-mimicking profile was identified is detected with F1 0.99.

Load-bearing premise

The paper's headline numbers assume that Cobalt Strike traffic generated in the authors' low-latency virtualized lab with four published malleable profiles is representative of real deployments, since the real-world HTTPS traces without a matching profile show clearly degraded performance.

Editorial extensions

If this is right

  • Security operations centers can deploy the method without deep packet inspection, since NetFlow v5/v9 are already exported by most routers.
  • The adaptive model selection means that adding a newly observed Cobalt Strike profile only requires training one additional per-domain model, not retraining the entire system.
  • Detection works over DNS as well as HTTP and HTTPS, closing a gap left by approaches that consider only encrypted web traffic.
  • When a mimicked domain is identifiable (for example via SNI before TLS 1.3 or via Host headers), the method's F1 reaches or approaches 1.0, so the most useful alerts arise exactly in the masquerade cases.
  • Because the classifier uses explainable features and MDI-based importance, defenders can articulate why a flow was flagged, which is harder with deep-learning detectors.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the per-domain models continue to transfer to unseen profiles within the same domain group (the paper's stated future work), the approach could be extended to profile-agnostic detection, where any new malleable profile mimicking a known domain is caught without retraining.
  • The authors' observation that benign datasets come from Linux hosts while Cobalt Strike beacons run on Windows highlights a latent confound: TCP flags such as CWR/ECE may distinguish operating systems rather than malice, so real deployments should retrain on their own benign baselines.
  • A testable extension would be to train on data-sending profiles such as cloud uploads or videoconferencing, which the authors suggest as future work, to see whether the size-asymmetry signal that drives the current models survives when benign traffic is also upload-heavy.
  • Because the method is not tied to Cobalt Strike-specific parameters, the same metadata features might detect other customizable C2 frameworks that adopt similar masquerading profiles, though this is not demonstrated in the paper.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper proposes a supervised Random Forest method to detect Cobalt Strike Command and Control traffic using only NetFlow v5/v9 metadata. The method includes an adaptive model-selection scheme: when the mimicked domain can be identified from Host headers, SNI, or IP prefixes, a domain-specific model is chosen; otherwise, generic models are used. The authors generate malicious traffic in a virtualized lab using four documented malleable profiles (Amazon, jQuery, Smashburger, default) over HTTP, HTTPS, and DNS, and evaluate with stratified 10-fold cross-validation. They report F1 scores between 0.78 and 1.0, with domain-specific models outperforming the Ramos et al. baseline when the mimicked domain is known. They also apply the method to real-world Malware Traffic Analysis traces, obtaining a high F1 for a jQuery HTTP trace and degraded performance for HTTPS traces with unknown profiles; retraining on those HTTPS traces yields high F1 scores. The artifacts are released on GitHub.

Significance. If the results hold, the paper offers a practical, explainable, and low-cost detection approach based on widely available NetFlow data, with an adaptive selection mechanism that is a genuine extension over prior Cobalt Strike detection work. The strengths are the use of documented real-world malleable profiles, careful removal of known biases (duration and CWR/ECE flags), release of artifacts, and evaluation against a baseline on external real-world traces. However, the real-world HTTPS evaluation is not a transfer test because models are trained on the same traces used for testing, and the comparison with the Ramos baseline is confounded by differing treatment of biased features. The central claim about generated-data performance is credible, but the stronger claims about real-world efficacy and state-of-the-art comparison need revision.

major comments (3)
  1. [6.4] The real-world HTTPS evaluation in §6.4, Table 8 is not a transfer test: the authors state 'we train four models on the HTTPS selected traces' and then report F1 scores from, presumably, a 10-fold cross-validation within each trace. Because training and test flows originate from the same attack session (same profile, server, and time window), these scores reflect within-trace memorization rather than the ability to detect unseen Cobalt Strike deployments. Consequently, the abstract's claim of 'good performance ... from real-world attacks' and the conclusion's statement that 'our method performance is similar to a previously proposed method on real-world attacks' are not supported for HTTPS traffic. I recommend either revising these claims, or re-evaluating with a train-on-generated/test-on-real protocol or leave-one-trace-out cross-validation, or clearly labeling Table 8 as an in-lab re-training result that does not measure wild detection performance.
  2. [6.2] The comparison with the Ramos et al. baseline is confounded by feature bias. The authors state in §6 that their own models are 'both without the features discarded in the previous paragraph' (the duration and CWR/ECE flags), but the Ramos baseline, which uses Zeek conn.log features including duration and TCP flag history, is not reported to have those features removed. Because the virtualized lab has artificially low RTT and jitter, duration is a strong and domain-specific discriminator; including it in the baseline (and excluding it from the proposed method) makes the stated 'outperforms the state of the art' comparison difficult to interpret. Please apply the same feature removal to the baseline, or provide a sensitivity analysis showing that the comparison is unaffected.
  3. [5.1] The adaptive model-selection component, which is the paper's claimed novelty, is not evaluated end-to-end on real-world traffic with uncertain domain identification. In §6.4, the HTTPS traces do not match any targeted profile, and the method falls back to generic models; the resulting 'downgraded performances' are only described qualitatively. It would strengthen the paper to quantify the fallback performance and to test the sensitivity of the method to errors in the domain-identification step (e.g., when the Host header or SNI is absent or attacker-controlled).
minor comments (5)
  1. [Abstract] There are typos in the abstract and conclusion: 'to performs equally' should be 'to perform equally,' and 'reproductible' should be 'reproducible.'
  2. [Table 2] The layout of Table 2 is ambiguous: counts are listed in a way that mixes benign and malicious totals within the same column (e.g., 'Amazon HTTP M 172' followed by 'B 615' is unclear). A two-column format with separate Benign and Malicious counts for each row would be clearer.
  3. [5.4] The hyperparameter grid search appears to be performed on the same folds used for evaluation; to avoid optimism, please clarify that the search is nested within each training fold, or report the effect of hyperparameter selection on the F1 scores.
  4. [6.4] The statement 'we train four models on the HTTPS selected traces' should be moved to a limitations paragraph or explicitly flagged as a re-training experiment, because as written it gives the impression of an external validation.
  5. [Figure 6] The MDI subplots in Figure 6 would benefit from larger fonts and clearer legends, especially the HTTPS panels (d) and (e).

Circularity Check

1 steps flagged · score 6.0 of 10

Real-world HTTPS evaluation is circular: models are trained on the same MTA traces they are then used to 'detect,' so the reported F1 scores do not demonstrate transfer to unseen deployments.

  1. fitted input called prediction [Section 6.4, 'Detection of documented real-world Cobalt Strike traffic' (paragraph after the downgraded-performance observation; results in Figure 7 and Table 8)]
    "To evaluate the capability of Netflow features-based models to detect real-world HTTPS Cobalt Strike traffic, we train four models on the HTTPS selected traces. ... We observe that in most cases, models based on Netflow v9 features equals or outdo the performances reached by Ramos et al. [53]. Thus, Netflow v9 based models are proficient to detect external HTTPS Command and Control but Netflow v5 can also be used to create simpler yet effective models."

    The four real-world HTTPS traces are first reported as not matching any trained profile, producing 'downgraded performances' with the method's actual generic-model branch. The authors then train models directly on those same HTTPS traces and report F1 scores (e.g., 0.92-0.98 for NetFlow v9 in Table 8). Because the same traces supply both the training data and the flows being classified, the reported values measure within-trace fit (at best internal cross-validation on one attack), not the ability to detect an unseen real-world Cobalt Strike deployment.

full rationale

The core lab-based evaluation is self-contained: models are trained on generated Cobalt Strike traffic and documented benign traffic, compared against Ramos et al. [53] using the same splits, and the features are standard NetFlow metadata. There is no load-bearing self-citation chain, and the adaptive model-selection idea is not defined in terms of the outcome it predicts. The single genuinely circular stretch is the real-world HTTPS evaluation in Section 6.4. After reporting that the four MTA HTTPS traces cannot be matched to a trained profile and that the generic-model branch gives 'downgraded performances,' the paper retrains models on 'the HTTPS selected traces' and then presents high F1 values as evidence that NetFlow-based models detect external HTTPS C2 traffic. Since the same traces are used for both training and evaluation, those F1 scores reduce to a within-trace fit and do not establish transfer to unseen real-world deployments. The jQuery HTTP result is non-circular, because that model was trained on self-generated jQuery traffic and tested on an external trace, but it covers only a single identified-profile case. Overall, the central method is independent and not circular, but the real-world HTTPS claim is partially circular, warranting a score of 6.

Assumptions & free parameters 1 free parameters · 6 assumptions · 0 invented entities

The central claim is a classifier, not a derivation. It relies on assumptions about attacker port choice, domain-name visibility, representativeness of lab-generated and public datasets, and correctness of external ground truth. The only fitted numbers are the Random Forest hyperparameters, which are tuned by grid search and are not part of a predicted quantity.

free parameters (1)
  • Random Forest hyperparameters (n_estimators, criterion, max_depth, min_samples_split) = selected by grid search over given ranges
    Section 5.4: grid search tunes number of trees (10/100/500), criterion (gini/entropy), depth (2/5/10/15/20), and min samples split (2/5/10/50); these are fitted to the training folds, though standard practice.
assumptions (6)
  • domain assumption The protocol of observed traffic is known from port numbers, and attackers use standard ports for HTTP, HTTPS, and DNS.
    Section 5.1: "we make the hypothesis that we know what protocol is used by the traffic to be classified (e.g. based on the UDP/TCP ports). Because the purpose of Cobalt Strike is to be stealthy... we suppose attackers use the same ports as benign traffic."
  • domain assumption A domain name can be extracted from plaintext Host/Referer headers or TLS SNI, or the remote IP falls in a known imitated domain prefix.
    Section 5.1 and Figure 3 describe this branching logic; if no domain is found the method falls back to generic models.
  • domain assumption Public benign datasets (UPC, UPNA, CTU) and Selenium-generated browsing are representative of benign traffic in a production network.
    Section 5.2 uses these datasets with an MTU filter; the authors note the datasets are several years old, a limitation acknowledged in Section 7.
  • domain assumption Malicious traffic generated in a virtualized Windows Server 2022 environment with low RTT is sufficiently representative of real Cobalt Strike deployments.
    Sections 5.2 and 6.4; the paper itself observes degraded performance on real HTTPS traces when the exact profile is absent, supporting that this assumption only partially holds.
  • domain assumption The profile selection based on the NCC Beacon dataset and TLSH/DBSCAN clustering correctly identifies the most deployed malleable profiles.
    Section 5.2, Table 4; the ranking drives which profiles are studied, so a miss in this clustering would change the evaluation scope.
  • domain assumption Ground-truth labels for the Malware Traffic Analysis traces are correct.
    Section 6.4 uses these external traces as real-world attacks; mislabeled flows would bias F1 estimates.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Striking Back At Cobalt: Using Network Traffic Metadata To Detect Cobalt Strike Masquerading Command and Control Channels." pith.science (2026). https://pith.science/paper/TBJUIZ3P

@misc{pith2026250608922,
  author       = {Pith},
  title        = {Pith review of: Striking Back At Cobalt: Using Network Traffic Metadata To Detect Cobalt Strike Masquerading Command and Control Channels},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TBJUIZ3P}},
  note         = {Machine review of arXiv:2506.08922}
}
read the original abstract

Off-the-shelf software for Command and Control is often used by attackers and legitimate pentesters looking for discretion. Among other functionalities, these tools facilitate the customization of their network traffic so it can mimic popular websites, thereby increasing their secrecy. Cobalt Strike is one of the most famous solutions in this category, used by known advanced attacker groups such as "Mustang Panda" or "Nobelium". In response to these threats, Security Operation Centers and other defense actors struggle to detect Command and Control traffic, which often use encryption protocols such as TLS. Network traffic metadata-based machine learning approaches have been proposed to detect encrypted malware communications or fingerprint websites over Tor network. This paper presents a machine learning-based method to detect Cobalt Strike Command and Control activity based only on widely used network traffic metadata. The proposed method is, to the best of our knowledge, the first of its kind that is able to adapt the model it uses to the observed traffic to optimize its performance. This specificity permits our method to performs equally or better than the state of the art while using standard features. Our method is thus easier to use in a production environment and more explainable.

Figures

Figures reproduced from arXiv: 2506.08922 by the authors.

Figure 1
Figure 1. Cobalt Strike architecture [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Examples of C2 communications based on HTTP and DNS. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Proposed method to detect Cobalt Strike C2 traffic. We use machine learning models trained on traffic [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: F1 score of the different models. Ramos et al. [53] uses generic DNS or HTTP and HTTPS combined benign traffic. Smashb.: Smashburger, NF: NetFlow The learning curves corresponding to these experiment in [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: Learning curves using F1 score with a confidence interval at a 95% threshold for the different feature groups. NF: NetFlow, Az: Amazon, D: default, Gen: generic, jQ: jQuery, Sb: smashburger. Strike. We suppose that specific benign traffic has a smaller variation in num…
Figure 6
Figure 6. Figure 6: Feature importance based on MDI with a confidence interval at a 99% threshold for Netflow v9. Only [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]
Figure 7
Figure 7. Figure 7: F1 score with a confidence interval at a 95% threshold for detecting masqueraded Cobalt Strike C2 observed in the wild. Ramos et al. [53] uses generic HTTP and HTTPS combined benign traffic. NF: NetFlow. 7 Ethics, discussion and future work We acknowledge that inspecti…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

74 extracted references · 74 canonical work pages

  1. [70]

    Yang, X., Ruan, S., Yue, Y., Sun, B.: Petnet: Plaintext-aware encrypted traffic detection network for identifying cobalt strike https traffics. Comput. Nets. (2024)

    work page 2024

  2. [1]

    In: ACM SIGCOMM IMC (2006)

    Abu Rajab, M., Zarfoss, J., Monrose, F., Terzis, A.: A multifaceted approach to understanding the botnet phe- nomenon. In: ACM SIGCOMM IMC (2006)

    work page 2006

  3. [2]

    Althouse, J.: Tls fingerprinting with ja3 and ja3s.https://engineering.salesforce.com/tls-fingerprinting- with-ja3-and-ja3s/(2019)

    work page 2019

  4. [3]

    Althouse, J.: Ja4+ network fingerprinting.https://blog.foxio.io/ja4%2B-network-fingerprinting(2023)

    work page 2023

  5. [4]

    In: AISec (2016)

    Anderson, B., McGrew, D.: Identifying encrypted malware traffic with contextual flow data. In: AISec (2016)

    work page 2016

  6. [5]

    Anderson, B., McGrew, D.: Accurate tls fingerprinting using destination context and knowledge bases (2020)

    work page 2020

  7. [6]

    CISRC ’16 (2016)

    Buczak, A.L., Hanke, P.A., Cancro, G.J., Toma, M.K., Watkins, L.A., Chavis, J.S.: Detection of tunnels in pcap data by random forests. CISRC ’16 (2016)

    work page 2016

  8. [7]

    Bujlow, T., Carela-Español, V., Barlet-Ros, P.: Independent comparison of popular dpi tools for traffic classifica- tion. Comput. Nets. (2015)

    work page 2015

Show all 74 references
  1. [8]

    Censys: Jarm in censys search.https://docs.censys.com/docs/ls-jarm

  2. [9]

    Chen, S., Lang, B., Liu, H., Li, D., Gao, C.: Dns covert channel detection method using the lstm model (2021)

    2021

  3. [10]

    Cisco: NetFlow v1, v5, v7 and v8.https://www.cisco.com/c/en/us/td/docs/net_mgmt/netflow_collection_ engine/3-6/user/guide/format.html(2007)

    2007

  4. [11]

    Cisco: NetFlow v9.https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_ paper09186a00800a3db9.html(2011)

    2011

  5. [12]

    CobaltStrike:https://www.cobaltstrike.com

  6. [13]

    CobaltStrike:https://www.cobaltstrike.com/help-malleable-c2

  7. [14]

    CobaltStrike: Official malleable profiles repository.https://github.com/Cobalt-Strike/Malleable-C2- Profiles(2014)

    2014

  8. [15]

    CobaltStrike:https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/ topics/listener-infrastructure_peer-2-peer.htm(2022)

    2022

  9. [16]

    CrowdStrike:https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june- mustang-panda/(2018)

    2018

  10. [17]

    Cybereason:https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors

  11. [18]

    In: EC2ND (2011)

    Dietrich, C., Rossow, C., Freiling, F., Bos, H., van Steen, M., Pohlmann, N.: On botnets that use dns for command and control. In: EC2ND (2011)

    2011

  12. [19]

    Rescorla, Mozilla: RFC on TLS 1.3.https://www.rfc-editor.org/rfc/rfc8446

    E. Rescorla, Mozilla: RFC on TLS 1.3.https://www.rfc-editor.org/rfc/rfc8446

  13. [20]

    Vincent van der Eijk, C.S.: Detecting Cobalt Strike beacons in NetFlow data (2020)

    2020

  14. [21]

    IEEE Access pp

    Elsadig, M.A., Gafar, A.: Covert channel detection: Machine learning approaches. IEEE Access pp. 38391–38405 (2022)

    2022

  15. [22]

    In: USENIX Security (2017)

    Felt, A.P., Barnes, R., King, A., Palmer, C., Bentzel, C., Tabriz, P.: Measuring https adoption on the web. In: USENIX Security (2017)

    2017

  16. [23]

    In: ESORICS (2005)

    Freiling, F., Holz, T., Wicherski, G.: Botnet tracking: Exploring a root-cause methodology to prevent distributed denial-of-service attacks. In: ESORICS (2005)

    2005

  17. [24]

    Elsevier Advanced Technology Publications (2014)

    García, S., Grill, M., Stiborek, J., Zunino, A.: An empirical comparison of botnet detection methods. Elsevier Advanced Technology Publications (2014)

    2014

  18. [25]

    Github:https://github.com/looCiprian/GC2-sheet

  19. [26]

    Github:https://github.com/YDHCUI/manjusaka

  20. [27]

    Github:https://github.com/BishopFox/sliver

  21. [28]

    Google Cybersecurity Action Team:https://services.google.com/fh/files/blogs/gcat_threathorizons_ full_apr2023.pdf(2023)

    2023

  22. [29]

    In: USENIX Security (2007)

    Gu, G., Porras, P., Yegneswaran, V., Fong, M.: Bothunter: Detecting malware infection through ids-driven dialog correlation. In: USENIX Security (2007)

    2007

  23. [30]

    In: NDSS Symposium (2008)

    Gu, G., Zhang, J., Lee, W.: Botsniffer: Detecting botnet command and control channels in network traffic. In: NDSS Symposium (2008)

    2008

  24. [31]

    Hu,Y.Z.:Miningdatafromcobaltstrikebeacons.https://www.nccgroup.com/us/research-blog/mining-data- from-cobalt-strike-beacons(2022)

    2022

  25. [32]

    In: Advances in Information and Comput

    Kondo, S., Sato, N.: Botnet traffic detection techniques by c&c session classification using svm. In: Advances in Information and Comput. Secur. (2007)

    2007

  26. [33]

    Kravensecurity: C2 hunting: How to find c2 servers with shodan.https://kravensecurity.com/c2-hunting- using-shodan/(2024)

    2024

  27. [34]

    In: Machine Learning for Networking (2020)

    Labayen, V., Magaña, E., Morató, D., Izal, M.: Network traffic and code for machine learning classification. In: Machine Learning for Networking (2020)

    2020

  28. [35]

    Labayen, V., Magaña, E., Morató, D., Izal, M.: Online classification of user activities using machine learning on network traffic. Comput. Nets. (2020) 18 C. Parssegny et al

    2020

  29. [36]

    In: LCN (2006)

    Livadas, C., Walsh, R., Lapsley, D., Strayer, W.T.: Using machine learning techniques to identify botnet traffic. In: LCN (2006)

    2006

  30. [37]

    Microsoft:https://www.microsoft.com/en-us/security/blog/2021/05/27/new-sophisticated-email- based-attack-from-nobelium/(2021)

    2021

  31. [38]

    Open Computer Science (2014)

    Mileva, A., Panajotov, B.: Covert channels in tcp/ip protocol stack - extended version-. Open Computer Science (2014)

    2014

  32. [39]

    MitreAtt&ck:https://attack.mitre.org/software/S0154/

  33. [40]

    MitreAtt&ck:https://attack.mitre.org/techniques/T1071/001/

  34. [41]

    MitreAtt&ck:https://attack.mitre.org/techniques/T1071/004/

  35. [42]

    MTA:https://www.malware-traffic-analysis.net/2023/01/31/

    2023

  36. [43]

    MTA:https://www.malware-traffic-analysis.net/2023/05/23/

    2023

  37. [44]

    MTA:https://www.malware-traffic-analysis.net/2023/07/12/

    2023

  38. [45]

    MTA:https://www.malware-traffic-analysis.net/2023/10/03/

    2023

  39. [46]

    MTA:https://www.malware-traffic-analysis.net/2023/11/06/

    2023

  40. [47]

    MTA:https://www.malware-traffic-analysis.net/2023/

    2023

  41. [48]

    Nayak, C.:https://bruteratel.com/

  42. [49]

    Nivargi, V., Bhaowa, M., Lee, T.: Machine Learning Based Botnet Detection (2006)

    2006

  43. [50]

    N.Mavis: The art and science of detecting Cobalt Strike (2020)

    2020

  44. [51]

    In: EUC 2021

    Oliver, J., Hagen, J.: Designing the elements of a fuzzy hashing scheme. In: EUC 2021

    2021

  45. [52]

    Pai, K., Shubhodeep, M., Madhusoodhana, S.: Novel tls signature extraction for malware detection (2020)

    2020

  46. [53]

    In: Machine Learning for Networking (2022)

    Ramos, F.M., Wang, X.: A machine learning based approach to detect stealthy cobalt strike c&c activities from encrypted network traffic. In: Machine Learning for Networking (2022)

    2022

  47. [54]

    In: ICMLA (2023)

    Ramos, F.M., Wang, X.: Detecting stealthy cobalt strike c&c activities via multi-flow based machine learning. In: ICMLA (2023)

    2023

  48. [55]

    Red Canary: Threat detection report.https://resource.redcanary.com/rs/003-YRU-314/images/2022_ ThreatDetectionReport_RedCanary.pdf(2022)

    2022

  49. [56]

    Salesforce: Easily identify malicious servers on the internet with jarm.https://engineering.salesforce.com/ easily-identify-malicious-servers-on-the-internet-with-jarm/(2020)

    2020

  50. [57]

    SentinelOne:https://www.sentinelone.com/blog/geacon-brings-cobalt-strike-capabilities-to-macos- threat-actors/(2023)

    2023

  51. [58]

    In: Advances in Cryptology

    Simmons, G.J.: The prisoners’ problem and the subliminal channel. In: Advances in Cryptology. pp. 51–67 (1984)

    1984

  52. [59]

    In: PAM 2023 (2023)

    Sosnowski, M., Zirngibl, J., Sattler, P., Carle, G.: DissecTLS: A Scalable Active Scanner for TLS Server Config- urations, Capabilities, and TLS Fingerprinting. In: PAM 2023 (2023)

    2023

  53. [60]

    In: TMA 2022 (2022)

    Sosnowski, M., Zirngibl, J., Sattler, P., Carle, G., Grohnfeldt, C., Russo, M., Sgandurra, D.: Active TLS Stack Fingerprinting: Characterizing TLS Server Deployments at Scale. In: TMA 2022 (2022)

    2022

  54. [61]

    Staniford-chen, S., Cheung, S., Crawford, R., Dilger, M., Frank, J., Hoagl, J., Levitt, K., Wee, C., Yip, R., Zerkle, D.: Grids : A graph based intrusion detection system for large networks (1998)

    1998

  55. [62]

    Stratosphere: Stratosphere laboratory datasets.https://www.stratosphereips.org/datasets-overview(2015)

    2015

  56. [63]

    Talos:https://blog.talosintelligence.com/manjusaka-offensive-framework

  57. [64]

    T.J.O’Leary, T.Bonner, M.Janus, D.Given, E.Wickens, J.Simpson: Finding Beacons In The Dark (2021)

    2021

  58. [65]

    Unit42:https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/(2022)

    2022

  59. [66]

    UPC:https://historic.cba.upc.edu/monitoring/traffic-classification.html(2015)

    2015

  60. [67]

    US district court for the eastern district of New York:https://noticeofpleadings.com/crackedcobaltstrike/ (2023)

    2023

  61. [68]

    In: RAID (2004)

    Wang, K., Stolfo, S.: Anomalous payload-based network intrusion detection. In: RAID (2004)

    2004

  62. [69]

    Warmer, M.: Detection of web based command & control channels. Ph.D. thesis (2011)

    2011

  63. [71]

    Zander, S., Armitage, G., Branch, P.: A survey of covert channels and countermeasures in computer network protocols (2007)

    2007

  64. [72]

    Zeek: conn.log.https://docs.zeek.org/en/master/logs/conn.html

  65. [73]

    Zeek: Zeek framework official website.https://zeek.org/

  66. [74]

    Zhang, H., Papadopoulos, C., Massey, D.: Detecting encrypted botnet traffic (2013)

    2013

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.