c2 framework
Cobalt Strike
The commercial red-team framework, seen on the site only as cracked builds staged by criminal operators. Named by 2 reports, 2 detection rules, 0 IOC feeds and 1 tracked actor.
Also written as: CobaltStrike, Cobalt Strike (cracked). These are the spellings the rules, feeds and profiles use; the page collects all of them.
Reports
Detection rules
YARA rules whose family metadata names this family, by detection page.
Detection rules
OpenStrike Expanded Toolkit — 106 New Files (2026-04-08)
MALW_ArtifactKit_EAXRedirect_Svc
Detection rules
OpenStrike Beacon Toolkit (172.105.0.126)
MALW_CobaltStrike3x_TripwiredReflectiveLoader
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-004: Developer of the OpenStrike multi-implant C2 toolkit, with a cracked Cobalt Strike arsenal
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.