Cobalt Strike Primer

command & control framework that provides a post-exploitation agent to simulate stealthy, long-term embedded actors.
tooling can be modified to disguise itself as known malware or legitimate services.
has built-in capabilities for performing multiple TTPs including initial compromise, privilege escalation, and lateral movement.
also has built-in reporting and MITRE mapping.

Beacon :
- the post-exploitation agent.
- Responsible for communicating back to a team server, fetching jobs, executing them, and returning results back
- implemented as a Windows DLL
- can alternatively be packaged in various formats such as executables, PS scripts, and shellcode
Team Server :
- central control and logging system
- stores information collected during an engagement
- builds up data models that can be used to generate reports and Beacon workflows
Client :
- used to connect one or more team servers to manage the engagement and interact with Beacon payloads.
- aggregates data from all team servers to provide single cohesive view of engagement

Team servers are created for each phase of engagement
if part of an operation is discovered and blocked, other channels can be used to maintain access