Cobalt Strike C2 Tracker

Overview

This playbook leverages the Shodan enrichment connector to run automated Shodan queries directly from OpenCTI, enabling several use cases like continuous tracking of threat actor infrastructure. The primary use case demonstrated here is Cobalt Strike infrastructure tracking, identifying internet-facing machines exposing Cobalt Strike's default SSL certificate serial number. By using Shodan-pattern indicators (where the indicator's pattern field contains a Shodan query), this playbook turns OpenCTI into an active reconnaissance tool for infrastructure monitoring.

Example query used to detect machines exposing Cobalt Strike's default certificate:

ssl.cert.serial:8BB00EE port:80,443,8443,7443,10443,50050

Dependencies

1. Shodan enrichment connector must be deployed and operational on the platform
2. Shodan-pattern indicator containing the relevant query must be created in OpenCTI prior to running the playbook
3. Indicator must be tagged with a specific tracker label (e.g., a "Cobalt Strike tracker" label) used as the filter in the first step

How to use it

1. Import the playbook into your OpenCTI platform
2. Create the Shodan-pattern indicators in OpenCTI, with the Shodan query provided in the "Overview" section above
3. Apply the appropriate tracker label to your indicator
4. Review the scheduler in the first component, it is set to run weekly every Monday by default
5. Verify that the label filter in the first component matches the tracker label applied to your indicator
6. Ensure the Shodan connector is active and reachable on the platform
7. Activate the playbook

Expected outcome

Each Monday, the playbook will execute the Shodan queries defined in your tagged indicators and retrieve matching results. A new grouping will be created weekly, consolidating all machines and associated information observed as exposing the tracked certificate or matching the query.

Additional detail

While this playbook is illustrated with a Cobalt Strike tracking use case, the same structure can be reused for any Shodan-based scenario by simply adapting the indicator pattern with the right Shodan query.