[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/) * [Japanese](https://unit42.paloaltonetworks.com/ja/cobalt-strike-malleable-c2-profile/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/ "Learning Hub") * [Cybersecurity Tutorials](https://unit42.paloaltonetworks.com/category/cybersecurity-tutorials/ "Cybersecurity Tutorials") [Cybersecurity Tutorials](https://unit42.paloaltonetworks.com/category/cybersecurity-tutorials/) # Cobalt Strike Analysis and Tutorial: How Malleable C2 Profiles Make Cobalt Strike Difficult to Detect ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Chris Navarrete](https://unit42.paloaltonetworks.com/author/chris-navarrete/) * [Durgesh Sangvikar](https://unit42.paloaltonetworks.com/author/durgesh-sangvikar/) * [Andrew Guan](https://unit42.paloaltonetworks.com/author/andrew-guan/) * [Yu Fu](https://unit42.paloaltonetworks.com/author/yu-fu/) * [Yanhui Jia](https://unit42.paloaltonetworks.com/author/yanhui-jia/) * [Siddhart Shibiraj](https://unit42.paloaltonetworks.com/author/siddhart-shibiraj/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:March 16, 2022 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybersecurity Tutorials](https://unit42.paloaltonetworks.com/category/cybersecurity-tutorials/) * [Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [C2](https://unit42.paloaltonetworks.com/tag/c2/) * [Cobalt Strike](https://unit42.paloaltonetworks.com/tag/cobalt-strike/) * [Cobalt Strike Series](https://unit42.paloaltonetworks.com/tag/cobalt-strike-series/) * [Malleable C2 profile](https://unit42.paloaltonetworks.com/tag/malleable-c2-profile/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/?pdf=download&lg=en&_wpnonce=40dbae5d0f "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/?pdf=print&lg=en&_wpnonce=40dbae5d0f "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Cobalt%20Strike%20Analysis%20and%20Tutorial:%20How%20Malleable%20C2%20Profiles%20Make%20Cobalt%20Strike%20Difficult%20to%20Detect&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fcobalt-strike-malleable-c2-profile%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fcobalt-strike-malleable-c2-profile%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fcobalt-strike-malleable-c2-profile%2F&title=Cobalt%20Strike%20Analysis%20and%20Tutorial:%20How%20Malleable%20C2%20Profiles%20Make%20Cobalt%20Strike%20Difficult%20to%20Detect "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fcobalt-strike-malleable-c2-profile%2F&text=Cobalt%20Strike%20Analysis%20and%20Tutorial:%20How%20Malleable%20C2%20Profiles%20Make%20Cobalt%20Strike%20Difficult%20to%20Detect "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fcobalt-strike-malleable-c2-profile%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Cobalt%20Strike%20Analysis%20and%20Tutorial:%20How%20Malleable%20C2%20Profiles%20Make%20Cobalt%20Strike%20Difficult%20to%20Detect%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fcobalt-strike-malleable-c2-profile%2F "Share in Mastodon") ## **Executive Summary** Cobalt Strike is commercial threat emulation software that emulates a quiet, long-term embedded actor in a network. This actor, known as Beacon, communicates with an external team server to emulate command and control (C2) traffic. Due to its versatility, Cobalt Strike is commonly used as a legitimate tool by red teams -- but is also widely used by threat actors for real-world attacks. Cobalt Strike users control Beacon's HTTP indicators through a profile, and can select either the default profile or a customizable Malleable C2 profile. In this blog post, we will go through the concepts and definitions associated with these profiles, and explore differences between default and customized Malleable C2 profiles used in the Cobalt Strike framework as well as in some true attacks in the wild. In doing so, we demonstrate how the Malleable C2 profile lends versatility to Cobalt Strike, and why this versatility makes Cobalt Strike an effective emulator for which it is difficult to design traditional firewall defenses. Palo Alto Networks customers receive protections against malicious uses of Cobalt Strike through Cortex XDR and the WildFire and Threat Prevention subscriptions for the Next-Generation Firewall. |------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Related Unit 42 Topics | [Cobalt Strike](https://unit42.paloaltonetworks.com/tag/cobalt-strike/), [C2](https://unit42.paloaltonetworks.com/tag/C2/), [Tutorials](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/) | ## **Profile Options for Cobalt Strike** The Cobalt Strike tool's primary configuration is specified using a profile file. The tool uses the values present in the profile to generate the Beacon payload, and users create the profile and set its values with a Malleable Command and Control (C2) profile language. The profile specifies how the beacon will transform and store data in a transaction. Within a profile, options are divided into global options and local options. Global options update the global Beacon settings, while local options are transaction-specific. Local option changes within one transaction do not affect the output from other transactions. The profile is divided into multiple sections to specify the values for different parts of the C2 communications. An [example](https://trial.cobaltstrike.com/help-malleable-c2) of a generic structure of the profile is as follows: # this is a comment set global\_option "value"; protocol-transaction { set local\_option "value"; client { \# customize client indicators } server { \# customize server indicators } } |----------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 | # this is a comment set global\_option "value"; protocol-transaction { set local\_option "value"; client { # customize client indicators } server { # customize server indicators } } | Different parts of the profile are explained below. ### Global Options Global options are global to C2 communications. Options such as sleeptime and jitter define the frequency of Beacon's check-in with the team server. Here is a list of a few global options with example values: set sample\_name "Profile Name"; set sleeptime "30000"; set jitter "20"; set useragent "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36"; set host\_stage "false"; |-----------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 | set sample\_name "Profile Name"; set sleeptime "30000"; set jitter "20"; set useragent "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36"; set host\_stage "false"; | If you are interested in a more comprehensive list of all the global options, refer to this [Cobalt Strike user guide.](https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/malleable-c2_profile-language.htm#_Toc65482842) ### Local Options On the other hand, the scope for local options is per transaction only. The options for one transaction do not affect the other. Examples of Local options: set uri "URI\_For HTTP transaction"; set verb "POST"; set uri\_x86 "StagetURI\_for\_x86"; set uri\_x64 "StagetURI\_for\_x64"; |---------|------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 | set uri "URI\_For HTTP transaction"; set verb "POST"; set uri\_x86 "StagetURI\_for\_x86"; set uri\_x64 "StagetURI\_for\_x64"; | In addition to these options, a profile can specify different protocol-transactions to carry out different actions. Below are example transactions, as well as brief explanations of their usage: * **http-stager**: The Beacon is a staged payload. The stager downloads the file and injects it into memory. The values listed in this transaction are customizing the HTTP communication for downloading the beacon. * **dns-beacon:** After Cobalt Strike v4.3, DNS options became part of the dns-beacon transaction. This transaction modifies the DNS C2 communication. If you are interested in a more comprehensive list of all the dns-beacon options, refer to this [Cobalt Strike user guide](https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/malleable-c2_dns-beacons.htm#_Toc65482850). * **http-get:** The http-get transaction customizes the HTTP communication between the Beacon and the team server. The Beacon starts by sending the HTTP request with metadata about the compromised system. If the team server has tasks to execute, the server sends an HTTP response. * **http-post:** Once the Beacon executes the tasks sent by the server, the output of the task is transferred in the http-post transaction. The values listed in this transaction affect the HTTP communication when the task output is sent over to the server. * **https-certificate:** If the Beacon is tasked to communicate over HTTPS, The team server generates a self-signed certificate. The team server uses http-get and http-post transaction values to create actual HTTP requests and responses. This profile transaction can help to specify the different parameters for SSL certificates. If you are interested in a more comprehensive list of all the http-certificates options, refer to this [Cobalt Strike user guide.](https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/malleable-c2_self-signed-ssl-certificates.htm#_Toc65482846) ![The Cobalt Strike default profile will be loaded if no other customized profiles are specified.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/03/word-image-32.png) Figure 1. Cobalt Strike default profile. ## **Cobalt Strike Default Profile** The default profile will be loaded if no other customized profiles are specified. Figure 1, above, is the specification of the default profile, and Figure 2, below, is an example of traffic capture from the default profile using the web drive-by-download option in a Cobalt Strike team server. ![This example of traffic capture from the default profile uses the web drive-by-download option in a Cobalt Strike team server.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/03/word-image-33.png) Figure 2. An example traffic capture from the default profile. From Figure 2, you can see that there are several HTTP transactions of GET and POST requests and responses. * For GET requests, most of the request URIs are very short and have predefined patterns. The URIs are randomly chosen from the list of URIs specified under set uri in the default profile in Figure 1 (see Table 1 below for the complete list). Malicious attackers can easily modify the URI to arbitrary strings if they use a customized profile with set uri options inside the http-get section. This also explains why a pattern-based signature might catch the Cobalt Strike traffic using default profiles very well, but fail to capture any variations with customized profiles. * For POST requests, there is a predefined pattern -- /submit.php?id= -- in the URI. The ID value is randomly generated. Similar to the possibilities for HTTP GET requests, malicious attackers can easily modify the URIs to arbitrary strings if they use customized profiles with set uri options inside the http-post section. |-------|--------------|-------|-----------|-------|------------------------| | Index | URIs | Index | URIs | Index | URIs | | 1 | /ca | 8 | /fwlink | 15 | /push | | 2 | /dpixel | 9 | /cm | 16 | /ptj | | 3 | /\_\_utm.gif | 10 | /cx | 17 | /j.ad | | 4 | /pixel.gif | 11 | /pixel | 18 | /ga.js | | 5 | /g.pixel | 12 | /match | 19 | /en\_US/all.js | | 6 | /dot.gif | 13 | /visit.js | 20 | /activity | | 7 | /updates.rss | 14 | /load | 21 | /IE9CompatViewList.xml | ^Table 1. Possible URIs specified in the Cobalt Strike default profile.^ ## Customized Cobalt Strike Profiles Public Malleable C2 profiles are available and can be downloaded in public repositories, such as from the official profiles examples on [GitHub](https://github.com/rsmudge/Malleable-C2-Profiles). These profiles can be loaded by the team server and used as a Beacon download for C2 communications. As an example, we walk through the [etumbot profile](https://github.com/rsmudge/Malleable-C2-Profiles/blob/master/APT/etumbot.profile) to explain in more detail below. 1. Global Options. * Sleeptime: The sleep time for the beacon callback is 5,000 milliseconds (5s). * Jitter: The jitter to set % is 0. In this example, the Beacon will call back every 5s because of the jitter value 0. * Maxdns: The maximum length of hostname is 255 when uploading data over DNS. * UserAgent: Set the HTTP C2 request useragent as "Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)" ![Public Malleable C2 profiles are available - see this example, showing global options in an Etumbot profile.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/03/word-image-34.png) Figure 3. Global options in Etumbot profile. 2. Beacon check-In to get task from teamserver with HTTP GET request. Below the global options, we find the following option configurations about HTTP request and response. Figures 4 and 5, below, show this configuration, which include URI, header and metadata information for both the client and the server. ![Red boxes highlight the HTTP Request URI, HTTP Request Header, Metadata Encoding Algorithm, Metadata Attached in URI, HTTP Response Header, Task Data Encrypted and Encoded as Response Body in a sample Malleable C2 profile.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/03/word-image-35.png) Figure 4. HTTP GET request options in Etumbot profile. ![Red boxes highlight the HTTP URI path, metadata encoded by Netbios, HTTP UA, and HTTP response header in a sample Malleable C2 profile.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/03/word-image-36.png) Figure 5. HTTP GET request in live traffic. 3. Beacon task execution result submission to teamserver with HTTP POST request. We can find the following option configuration about HTTP response from Figure 6 below, as well as what the POST C2 traffic looks like in Figure 7. ![Red boxes highlight the HTTP request URI, HTTP request header, HTTP request sessionID attached in URI, HTTP request payload for command execution result, HTTP response header, and HTTP response body in a sample malleable C2 profile.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/03/word-image-37.png) Figure 6. HTTP POST request options in Etumbot profile. ![Red boxes highlight the HTTP URI path, session ID encoded by Netbios, HTTP URI path postfix, HTTP request header, HTTP request UA, task execution result encoded by Base64 and HTTP response header in a sample malleable C2 profile.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/03/word-image-38.png) Figure 7. HTTP POST request options in live traffic. ## **Cases in the Wild** The following sections show two different cases of Cobalt Strike payloads used in the wild: one using the default option (no profiles) and the other with a custom profile. Both samples have no trigger on VirusTotal at the time of this writing, but Palo Alto Networks identified them using static and dynamic analysis. ### Default Profile Sample SHA256 Hash: 6a6e5d2faeded086c3a97e14994d663e2ff768cb3ad1f5a1aa2a2b5fd344dde2 ![Cobalt Strike HTTP GET Beacon download request with default profile](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/03/word-image-39.png) Figure 8. Cobalt Strike HTTP GET Beacon download request. ![Cobalt Strike HTTP GET heartbeat request with default profile](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/03/word-image-40.png) Figure 9. Cobalt Strike HTTP GET heartbeat request. ![Cobalt Strike HTTP POST call-back request with default profile](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/03/word-image-41.png) Figure 10. Cobalt Strike HTTP POST call-back request. As seen in Figures 9 and 10, the GET and POST requests follow from the configuration options specified in the default profile. The GET request URI is /load (Figure 9), which is one of the default options for GET requests, and the POST request URI is /submit.php (Figure 10), which is the default option for POST requests. If all Cobalt Strike traffic used these default URIs, it would be much easier to write signatures to identify Cobalt Strike traffic; however, these signatures would not be able to identify traffic originating from customized profiles, as shown in the next example. ### Customized Profile Sample SHA256 Hash: fcdc426289dab0e5a73cd6fbac928ad48a8ff9b67e1d37df2794af6e7fa559e9 ![Cobalt Strike HTTP GET Beacon download request with a customized malleable C2 profile](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/03/word-image-42.png) Figure 11. Cobalt Strike HTTP GET Beacon download request. ![Cobalt Strike HTTP GET heartbeat request with a customized malleable C2 profile](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/03/word-image-43.png) Figure 12. Cobalt Strike HTTP GET heartbeat request. ![Cobalt Strike HTTP POST call-back request with a customized malleable C2 profile.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/03/word-image-44.png) Figure 13. Cobalt Strike HTTP POST call-back request. As we can see in Figures 12 and 13, the GET and POST request URIs have changed from the default profile. Both of these URIs are prepended with /MicrosoftUpdate in order to seem like a legitimate HTTP request to Microsoft servers for regular Windows updates -- but are actually request and response traffic from C2 servers. This is how Cobalt Strike traffic from customized profiles can be so flexible and difficult to detect. ## **Cobalt Strike Beacon Configuration** In addition to the differences in GET and POST request parameters mentioned previously, Cobalt Strike Beacon configuration differs between default and custom profiles, and it contains useful metadata according to the settings in a Malleable C2 profile, which includes encoding types, blog submission mechanisms, instructions used to perform data transformations and other properties. By leveraging Didier Stevens's [1768.py](https://blog.didierstevens.com/2021/11/21/update-1768-py-version-0-0-10/) script, a researcher can decode and extract Cobalt Strike Beacon configurations. Didier is a security researcher known for his development of several analysis tools and other security-related topics. ![A screenshot showing extracted configuration metadata for a custom profile Beacon.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/03/word-image-45.png) Figure 14. Custom profile Beacon configuration Metadata. Figure 14 shows extracted configuration metadata for a custom profile Beacon. The most visible differences between a default profile and a custom profile Beacon configuration are the number of instructions and data transformations, as well as the HTTP parameters used. The table below shows the full list of differences between configuration metadata of the default and custom profile samples found in the wild that were previously discussed. |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Default Profile (Beacon** **/Iya9** **)** | **Custom Profile (Beacon** **/api/1** **)** | | 0x000a post-uri 0x0003 0x0040 **'** /submit.php' 0x000b Malleable\_C2\_Instructions 0x0003 0x0100 Transform Input: \[7:Input,4\] Print 0x000c http\_get\_header 0x0003 0x0200 Build Metadata: \[7:Metadata,3,6:Cookie\] BASE64 Header Cookie 0x000d http\_post\_header 0x0003 0x0200 Const\_header Content-Type: application/octet-stream Build SessionId: \[7:SessionId,5:id\] Parameter id Build Output: \[7:Output,4\] Print | 0x000a post-uri 0x0003 0x0040 '/MicrosoftUpdate/GetUpdate/KB' 0x000b Malleable\_C2\_Instructions 0x0003 0x0100 Transform Input: \[7:Input,4\] Print 0x000c http\_get\_header 0x0003 0x0100 Const\_header User-Agent: Mozilla/4.0 (Compatible; MSIE 6.0;Windows NT 5.1) Const\_header Accept: \*/\*, ..., ......, . Build Metadata: \[7:Metadata,11,5:tmp\] NETBIOS uppercase Parameter tmp 0x000d http\_post\_header 0x0003 0x0100 Const\_header Content-Type: application/octet-stream Const\_header User-Agent: Mozilla/4.0 (Compatible; MSIE 6.0;Windows NT 5.1) Build SessionId: \[7:SessionId,1:/default.asp,12\] Append /default.asp Uri\_append Build Output: \[7:Output,4\] Print | ^Table 2. Default profile vs custom Profile configuration meta-data.^ ## **Conclusion** Cobalt Strike is a potent post-exploitation adversary emulator. The Malleable C2 profile detailed above is elaborate and is designed to evade security detections. A single security appliance is not equipped to prevent a Cobalt Strike attack. Only a combination of security solutions -- firewalls, sandboxes, endpoints and software to integrate all these components can help prevent this kind of attack. Palo Alto Networks customers are protected from this kind of attack by the following: 1. [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) (NGFWs) with [Threat Prevention](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) signatures 86445 and 86446 identify HTTP C2 requests with default profiles. 2. [WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire), an NGFW security subscription identifies and blocks Cobalt Strike Beacon. 3. [AutoFocus](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/autofocus) users can track this activity using the [CobaltStrike](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Cobaltstrike) tags ## **Indicators of Compromise** ### CS Samples * 6a6e5d2faeded086c3a97e14994d663e2ff768cb3ad1f5a1aa2a2b5fd344dde2 * fcdc426289dab0e5a73cd6fbac928ad48a8ff9b67e1d37df2794af6e7fa559e9 ### CS Beacon Samples * /Iya9 * 08e901d4ed0b43b46e632158f5ec5e900f16015e18995a875f62903a3c1eb1f9 * /api/1 * d8b385d680bcdf7646f35df612712f7a3991f50a21cac8379630d05b3d2337ae ### CS Team Server Domain * www.symantecav\[.\]xyz ### CS Team Server IP addresses * 66\.42.72\[.\]250 * 146\.0.77\[.\]110 ## **Additional Resources** * [Cobalt Strike Training](https://www.cobaltstrike.com/training) * [Cobalt Strike Malleable C2 Profile](https://www.cobaltstrike.com/help-malleable-c2) * [Cobalt Strike Attack Detection \& Defense Technology Overview](https://live.paloaltonetworks.com/t5/blogs/cobalt-strike-attack-detection-amp-defense-technology-overview/ba-p/533753) Back to top ### Tags * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [Cobalt Strike](https://unit42.paloaltonetworks.com/tag/cobalt-strike/ "Cobalt Strike") * [Cobalt Strike Series](https://unit42.paloaltonetworks.com/tag/cobalt-strike-series/ "Cobalt Strike Series") * [Malleable C2 profile](https://unit42.paloaltonetworks.com/tag/malleable-c2-profile/ "malleable C2 profile") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Container Escape to Shadow Admin: GKE Autopilot Vulnerabilities](https://unit42.paloaltonetworks.com/gke-autopilot-vulnerabilities/ "Container Escape to Shadow Admin: GKE Autopilot Vulnerabilities") ### Table of Contents * ### Related Articles * [Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "article - table of contents") * [TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development](https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/ "article - table of contents") * [Boggy Serpens Threat Assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/ "article - table of contents") ## Related Cybersecurity Tutorials Resources ![A Black man in business attire using a tablet, with illuminated skyscrapers in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/01_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) March 1, 2024 [#### Wireshark Tutorial: Exporting Objects From a Pcap](https://unit42.paloaltonetworks.com/using-wireshark-exporting-objects-from-a-pcap/) * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/ "Wireshark Tutorial") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/using-wireshark-exporting-objects-from-a-pcap/ "Wireshark Tutorial: Exporting Objects From a Pcap") ![A man wearing headphones with a microphone is focused on multiple computer screens displaying graphs and data, indicating involvement in a professional tech or analytics environment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/02_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) October 10, 2023 [#### Wireshark Tutorial: Identifying Hosts and Users](https://unit42.paloaltonetworks.com/using-wireshark-identifying-hosts-and-users/) * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/ "Wireshark Tutorial") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/using-wireshark-identifying-hosts-and-users/ "Wireshark Tutorial: Identifying Hosts and Users") ![An abstract illustration of a video that has been paused. It includes a red progress bar and a large white Play button.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/03_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) September 8, 2023 [#### Wireshark Tutorial: Display Filter Expressions](https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/) * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/ "Wireshark Tutorial") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/ "Wireshark Tutorial: Display Filter Expressions") ![A person focuses intently on a screen, with many lines of code on the monitor reflected in their glasses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/04_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) September 1, 2023 [#### RedLine Stealer: Answers to Unit 42 Wireshark Quiz](https://unit42.paloaltonetworks.com/wireshark-quiz-redline-stealer-answers/) * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/ "Wireshark Tutorial") * [Redline infostealer](https://unit42.paloaltonetworks.com/tag/redline-infostealer/ "Redline infostealer") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/wireshark-quiz-redline-stealer-answers/ "RedLine Stealer: Answers to Unit 42 Wireshark Quiz") ![A man wearing headphones with a microphone is focused on multiple computer screens displaying graphs and data, indicating involvement in a professional tech or analytics environment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/02_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) August 31, 2023 [#### Wireshark Tutorial: Changing Your Column Display](https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/) * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/ "Wireshark Tutorial") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/ "Wireshark Tutorial: Changing Your Column Display") ![Person wearing glasses and a hoodie, sitting in a dimly lit room, focused on a computer screen displaying complex data visualizations.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/06_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) August 18, 2023 [#### Crossing the Line: Unit 42 Wireshark Quiz for RedLine Stealer](https://unit42.paloaltonetworks.com/wireshark-quiz-redline-stealer/) * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Redline infostealer](https://unit42.paloaltonetworks.com/tag/redline-infostealer/ "Redline infostealer") * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/ "Wireshark Tutorial") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/wireshark-quiz-redline-stealer/ "Crossing the Line: Unit 42 Wireshark Quiz for RedLine Stealer") ![A man wearing headphones with a microphone is focused on multiple computer screens displaying graphs and data, indicating involvement in a professional tech or analytics environment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/02_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) May 30, 2023 [#### Cold as Ice: Answers to Unit 42 Wireshark Quiz for IcedID](https://unit42.paloaltonetworks.com/wireshark-quiz-icedid-answers/) * [Banking trojans](https://unit42.paloaltonetworks.com/tag/banking-trojans/ "banking trojans") * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/wireshark-quiz-icedid-answers/ "Cold as Ice: Answers to Unit 42 Wireshark Quiz for IcedID") ![A woman is intently working on a computer in a modern office environment, surrounded by screens displaying dynamic digital data and stock market numbers, highlighting a focus on financial analysis.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/04_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) May 26, 2023 [#### Cold as Ice: Unit 42 Wireshark Quiz for IcedID](https://unit42.paloaltonetworks.com/wireshark-quiz-icedid/) * [Banking trojans](https://unit42.paloaltonetworks.com/tag/banking-trojans/ "banking trojans") * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/wireshark-quiz-icedid/ "Cold as Ice: Unit 42 Wireshark Quiz for IcedID") ![Two people working in a modern office environment with one person concentrating on a computer screen displaying code while another person works in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/10_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) May 15, 2023 [#### It's All in the Name: How Unit 42 Defines and Tracks Threat Adversaries](https://unit42.paloaltonetworks.com/from-activity-to-formal-naming/) * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [Nomenclature](https://unit42.paloaltonetworks.com/tag/nomenclature/ "nomenclature") * [Threat actors](https://unit42.paloaltonetworks.com/tag/threat-actors/ "threat actors") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/from-activity-to-formal-naming/ "It’s All in the Name: How Unit 42 Defines and Tracks Threat Adversaries") ![A Black man in business attire using a tablet, with illuminated skyscrapers in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/01_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) March 27, 2023 [#### Finding Gozi: Answers to Unit 42 Wireshark Quiz, March 2023](https://unit42.paloaltonetworks.com/march-wireshark-gozi-answers/) * [Gozi](https://unit42.paloaltonetworks.com/tag/gozi/ "Gozi") * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/march-wireshark-gozi-answers/ "Finding Gozi: Answers to Unit 42 Wireshark Quiz, March 2023") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)