Shodan 101 : How to Hunt Malicious Cobalt Strike Activity?
While Googling Everything Along the Way :)
Disclaimer!
The queries provided are designed to return tentative results, but these findings are not verified. Further investigation is required to determine whether the results indicate malicious activity.
The purpose of this blog is to promote responsible and effective search practices for educational purposes only. Under no circumstances should it be used for malicious intent. The blog’s owner is not responsible for any actions taken based on these results ,nor for any individuals imitating or misusing the information for harmful purposes.
What is Shodan. io?
Shodan.io is a search engine specifically designed for finding and indexing devices connected to the internet.
“It is a search engine for the Internet of Everything.”
You can use Filters in Shodan to enrich your searches, more information can be found here :
Searching for Possible Cobalt Strike Beacons based on Certificate Issuer.
The following query checks if SSL certificate contains the string “Pwn3rs Strike, reports of a leaked CS version was seen associated with the group Pwn3rs, there is a good research referenced here : https://blog.cyphur.com/detecting-leaked-cobalt-strike/
product:"Cobalt Strike Beacon" ssl:"Pwn3rs Striked"Searching for Possible Cobalt Strike Beacons based on watermark.
The following query looks for string : watermark. Cobalt Strike watermarks are a unique value generated from and tied to a given “CobaltStrike.auth” file(License file).
Get Nived Sawant’s stories in your inbox
Join Medium for free to get updates from this writer.
Top results were for watermark: 987654321,666666666,391144938
product:"Cobalt Strike Beacon" watermark:"987654321"Searching GET and POST HTTP URI for (.php, .js files)in Cobalt strike beacons
product:"Cobalt Strike Beacon" http-get.uri:".php"
product:"Cobalt Strike Beacon" http-get.uri:".js"
product:"Cobalt Strike Beacon" http-post.uri:".php"
product:"Cobalt Strike Beacon" http-post.uri:".js"Searching for Post exploitation parameters(.dll, .exe file extensions) in the Cobalt Strike Beacons
product:"Cobalt Strike Beacon" post-ex.spawnto_x64:".exe" OR post-ex.spawnto_x64:".dll" 
