Special: Coordinated Release of Detection Rules for CobaltStike Abuse

Guest:

• Greg Sinclair, Security Engineer @ Google Cloud

Topics:

• Could you tell us a bit about your background and how you ended up here at Google? Also, tell us about your team here?
• We're very excited about the release of the CobaltStrike rules. Could you share more about what they are looking for and second why this is so valuable?
• How did CobaltStrike come to be so widely used by bad guys?
• When you were doing this research what was the most surprising thing you uncovered?
• Could you tell us about the coordinated disclosure aspects of this work?
• In the past you've contributed research to our Threat Horizons reports, could you tell us about that?

Resources:

• Making CobaltStike harder for threat actors to abuse blog
• CobaltStrike YARA-L rules
• CobaltStrike site
• “Cobalt Strike Usage Explodes Among Cybercrooks”
• Google Cybersecurity Action Team Threat Horizons Report #4 Is Out!
• Detection as Code? No, Detection as COOKING!