Detecting Stealthy Cobalt Strike C&C Activities via Multi-Flow based Machine Learning

Cobalt Strike is a penetration testing software that supports stealthy command and control (C&C). As Cobalt Strike C&C always encrypts its payload and can mimic various normal traffic (e.g., HTTP, HTTPS), it is very difficult to distinguish and detect stealthy Cobalt Strike C&C traffic from normal (encrypted) traffic. As a result, many recent cyber attacks (e.g., 2020 SolarWind data breach) used Cobalt Strike C&C to surreptitiously control compromised systems and exfiltrate sensitive data without being detected. To protect our mission critical systems from sophisticated cyber attacks, it is critically important to develop capabilities to effectively detect real world Cobalt Strike C&C activities from encrypted traffic. In this paper, we investigate how machine learning models can help detect stealthy Cobalt Strike C&C activities from encrypted traffic. Based on analysis of real world Cobalt Strike C&C traffic, we have developed novel machine learning features across multiple packet flows that capture some inherent characteristics of encrypted Cobalt Strike C&C traffic. We have evaluated several machine learning algorithms with our multi-flow based machine learning features and real world Cobalt Strike C&C traffic captured from real world cyber attacks Our experimental results demonstrate that our neural network based detection is able to detect 90.9% real world Cobalt Strike C&C activities with 0.4% false positive rate.