Colbatstrike hashes

[Scop-bot]

Hi,
Do you know how to find the hashes that correspond to Cobalt Strike servers, the source they came from?

If we suppose that entity A steals Cobalt Strike from entity B, is this visible on A's server? And if we suppose that an entity does not use a single server but several, can we identify all of an attacker's Cobalt Strike servers?

Thanks for your help :)

[thehappydinoa]

I found this massive list of Cobalt Strike JARMS: https://github.com/carbonblack/active_c2_ioc_public/blob/main/cobaltstrike/JARM/jarm_cs_202107_uniq_sorted.txt
This list also has other types of C2 JARMS: https://github.com/cedowens/C2-JARM