Cobalt Strike is a commercially available tool used by red teamers and penetration testers as an adversary simulation tool and post-exploitation framework. This tool is heavily used by malicious actors during active breaches. Detection of Cobalt Strike on a network is often an indicator that a ransomware deployment is imminent.

Cobalt Strike is primarily used by cybersecurity professionals to conduct ethical hacking exercises or red teaming engagements, in which they attempt to breach an organization’s defenses and identify vulnerabilities that could be exploited by real attackers. It can be used to test the security of network infrastructure, applications, and operating systems.