New Snort, ClamAV coverage strikes back against Cobalt Strike
Summary: Cisco Talos released more than 50 new Snort and ClamAV signatures, combined with prior coverage, to detect obfuscation and data exfiltration via Cobalt Strike, alongside a research paper titled "The Art and Science of Detecting Cobalt Strike." Talos reports that Cobalt Strike accounted for 66 percent of all ransomware attacks its Incident Response team responded to in Summer 2020, and the toolkit has appeared in APT campaigns, the IndigoDrop campaign, and numerous ransomware attacks.
Key Takeaway: Cobalt Strike is a paid red-team platform that adversaries use to gain and control infected hosts, and Talos ties it to two-thirds of the ransomware incidents its IR team handled in a single quarter - so detection coverage for this one toolkit carries outsized weight in a ransomware defense posture.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026