{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:TBJUIZ3PGFLQRP7UZXJGWTZDXO","short_pith_number":"pith:TBJUIZ3P","canonical_record":{"source":{"id":"2506.08922","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-10T15:47:22Z","cross_cats_sorted":[],"title_canon_sha256":"b08eff824c7f3763d3792155fe73ce491989d821655d857dd57fa80d0b5f550c","abstract_canon_sha256":"2b50a38afc568f765fcb0afe266e53e497f5f92744ed3d1184bad26e2a0f7628"},"schema_version":"1.0"},"canonical_sha256":"985344676f315708bff4cdd26b4f23bb8b34c2d8d2ae243b28f6b81012950a1d","source":{"kind":"arxiv","id":"2506.08922","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.08922","created_at":"2026-07-05T11:19:15Z"},{"alias_kind":"arxiv_version","alias_value":"2506.08922v1","created_at":"2026-07-05T11:19:15Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.08922","created_at":"2026-07-05T11:19:15Z"},{"alias_kind":"pith_short_12","alias_value":"TBJUIZ3PGFLQ","created_at":"2026-07-05T11:19:15Z"},{"alias_kind":"pith_short_16","alias_value":"TBJUIZ3PGFLQRP7U","created_at":"2026-07-05T11:19:15Z"},{"alias_kind":"pith_short_8","alias_value":"TBJUIZ3P","created_at":"2026-07-05T11:19:15Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:TBJUIZ3PGFLQRP7UZXJGWTZDXO","target":"record","payload":{"canonical_record":{"source":{"id":"2506.08922","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-10T15:47:22Z","cross_cats_sorted":[],"title_canon_sha256":"b08eff824c7f3763d3792155fe73ce491989d821655d857dd57fa80d0b5f550c","abstract_canon_sha256":"2b50a38afc568f765fcb0afe266e53e497f5f92744ed3d1184bad26e2a0f7628"},"schema_version":"1.0"},"canonical_sha256":"985344676f315708bff4cdd26b4f23bb8b34c2d8d2ae243b28f6b81012950a1d","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:19:15.094718Z","signature_b64":"w3FEPBRKFsjFCC5w5PwQj61C0q3DHfS5RLOkNCj2DH9rszXyOwFuG1EQ4GXzoLYP+K+GSL5hwfmzctQgBgqiCw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"985344676f315708bff4cdd26b4f23bb8b34c2d8d2ae243b28f6b81012950a1d","last_reissued_at":"2026-07-05T11:19:15.094221Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:19:15.094221Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.08922","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:19:15Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"AKbYdtqVYFNrZVYE1LRtwY90Lur8hJ5OvRWF2DXX3xYEx7NloyICTQHlMZWJsyDK3pytOnsKjqeibfNl091JAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T11:02:49.523166Z"},"content_sha256":"f52a17fcad9527c52d64a169d5e681f0871470742cec41f89679ddb090390533","schema_version":"1.0","event_id":"sha256:f52a17fcad9527c52d64a169d5e681f0871470742cec41f89679ddb090390533"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:TBJUIZ3PGFLQRP7UZXJGWTZDXO","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Striking Back At Cobalt: Using Network Traffic Metadata To Detect Cobalt Strike Masquerading Command and Control Channels","license":"http://creativecommons.org/licenses/by-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Cl\\'ement Parssegny, Johan Mazel, Olivier Levillain, Pierre Chifflier","submitted_at":"2025-06-10T15:47:22Z","abstract_excerpt":"Off-the-shelf software for Command and Control is often used by attackers and legitimate pentesters looking for discretion. Among other functionalities, these tools facilitate the customization of their network traffic so it can mimic popular websites, thereby increasing their secrecy. Cobalt Strike is one of the most famous solutions in this category, used by known advanced attacker groups such as \"Mustang Panda\" or \"Nobelium\". In response to these threats, Security Operation Centers and other defense actors struggle to detect Command and Control traffic, which often use encryption protocols "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.08922","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.08922/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:19:15Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"fq+0Dq+lFR17BMWAcJBZR33RIIiYasVamjfnKzOZgYm/SO8rkncmd1Fxcrnz5MJCEyDzFjx1GXf+ORFDneLhBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T11:02:49.524726Z"},"content_sha256":"8e134bad70eeb4d117f26b8c897d2374f4e2e006aa81c4a7b79d47f7032ad170","schema_version":"1.0","event_id":"sha256:8e134bad70eeb4d117f26b8c897d2374f4e2e006aa81c4a7b79d47f7032ad170"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/TBJUIZ3PGFLQRP7UZXJGWTZDXO/bundle.json","state_url":"https://pith.science/pith/TBJUIZ3PGFLQRP7UZXJGWTZDXO/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/TBJUIZ3PGFLQRP7UZXJGWTZDXO/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-10T11:02:49Z","links":{"resolver":"https://pith.science/pith/TBJUIZ3PGFLQRP7UZXJGWTZDXO","bundle":"https://pith.science/pith/TBJUIZ3PGFLQRP7UZXJGWTZDXO/bundle.json","state":"https://pith.science/pith/TBJUIZ3PGFLQRP7UZXJGWTZDXO/state.json","well_known_bundle":"https://pith.science/.well-known/pith/TBJUIZ3PGFLQRP7UZXJGWTZDXO/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:TBJUIZ3PGFLQRP7UZXJGWTZDXO","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"2b50a38afc568f765fcb0afe266e53e497f5f92744ed3d1184bad26e2a0f7628","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-10T15:47:22Z","title_canon_sha256":"b08eff824c7f3763d3792155fe73ce491989d821655d857dd57fa80d0b5f550c"},"schema_version":"1.0","source":{"id":"2506.08922","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.08922","created_at":"2026-07-05T11:19:15Z"},{"alias_kind":"arxiv_version","alias_value":"2506.08922v1","created_at":"2026-07-05T11:19:15Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.08922","created_at":"2026-07-05T11:19:15Z"},{"alias_kind":"pith_short_12","alias_value":"TBJUIZ3PGFLQ","created_at":"2026-07-05T11:19:15Z"},{"alias_kind":"pith_short_16","alias_value":"TBJUIZ3PGFLQRP7U","created_at":"2026-07-05T11:19:15Z"},{"alias_kind":"pith_short_8","alias_value":"TBJUIZ3P","created_at":"2026-07-05T11:19:15Z"}],"graph_snapshots":[{"event_id":"sha256:8e134bad70eeb4d117f26b8c897d2374f4e2e006aa81c4a7b79d47f7032ad170","target":"graph","created_at":"2026-07-05T11:19:15Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.08922/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Off-the-shelf software for Command and Control is often used by attackers and legitimate pentesters looking for discretion. Among other functionalities, these tools facilitate the customization of their network traffic so it can mimic popular websites, thereby increasing their secrecy. Cobalt Strike is one of the most famous solutions in this category, used by known advanced attacker groups such as \"Mustang Panda\" or \"Nobelium\". In response to these threats, Security Operation Centers and other defense actors struggle to detect Command and Control traffic, which often use encryption protocols ","authors_text":"Cl\\'ement Parssegny, Johan Mazel, Olivier Levillain, Pierre Chifflier","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-10T15:47:22Z","title":"Striking Back At Cobalt: Using Network Traffic Metadata To Detect Cobalt Strike Masquerading Command and Control Channels"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.08922","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:f52a17fcad9527c52d64a169d5e681f0871470742cec41f89679ddb090390533","target":"record","created_at":"2026-07-05T11:19:15Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"2b50a38afc568f765fcb0afe266e53e497f5f92744ed3d1184bad26e2a0f7628","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-10T15:47:22Z","title_canon_sha256":"b08eff824c7f3763d3792155fe73ce491989d821655d857dd57fa80d0b5f550c"},"schema_version":"1.0","source":{"id":"2506.08922","kind":"arxiv","version":1}},"canonical_sha256":"985344676f315708bff4cdd26b4f23bb8b34c2d8d2ae243b28f6b81012950a1d","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"985344676f315708bff4cdd26b4f23bb8b34c2d8d2ae243b28f6b81012950a1d","first_computed_at":"2026-07-05T11:19:15.094221Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:19:15.094221Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"w3FEPBRKFsjFCC5w5PwQj61C0q3DHfS5RLOkNCj2DH9rszXyOwFuG1EQ4GXzoLYP+K+GSL5hwfmzctQgBgqiCw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:19:15.094718Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.08922","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:f52a17fcad9527c52d64a169d5e681f0871470742cec41f89679ddb090390533","sha256:8e134bad70eeb4d117f26b8c897d2374f4e2e006aa81c4a7b79d47f7032ad170"],"state_sha256":"e9e56147e183bf9580131b955336223ccbdd100532fa662935178c7e55d4cf54"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"c7mgZv1htC6vSAQKuYsS39pKmQLLuzOFu/4jIj0VrTu9R70Lsu3IVDuxsttP5bJlNcA4J5rcqYFjJc5Vq56FDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-10T11:02:49.532402Z","bundle_sha256":"b4b0fdc083cba0bd703d72a70e1b508d3d65391d6089ddceda90b4b4ddd93cda"}}