A Morning with Cobalt Strike & Symantec

A penetration tester describes experiments using Cobalt Strike to deliver PowerShell-generated 32-bit and 64-bit payloads against Symantec endpoint protection. 32-bit payloads triggered IPS alerts and were blocked, while 64-bit shellcode established C2 in multiple configurations; however, an Amazon-like HTTP GET profile triggered Symantec HIPS to reset TCP connections, and a minor modification to the GET path bypassed that detection. The report highlights that custom, widely published C2 profiles can be signatured and that memory-delivered 64-bit shellcode may still succeed against some endpoint defenses.