# Hunting Cobalt Strike C2 with Shodan

**[michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2](https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2)**

Michael Koczwara September 25, 2021

Mic
hael


[Michael Koczwara](https://michaelkoczwara.medium.com/?source=post_page-----c448d501a6e2--------------------------------)

Sep 7, 2021


2 min read


-----

Cobalt Strike C2 Hunting
**Four techniques:**

Default certificate.
Hash + 50050 port (FP filtering is required).
JARM (FP filtering is required).
ASN/ISP scanning (this one is handy for subnet pivoting).

You can read my Twitter thread where I explained the logic behind each technique.

-
Love podcasts or audiobooks? Learn on the go with our new app.


-----

[Try Knowable](https://knowable.fyi/?utm_source=medium&utm_medium=referral&utm_campaign=medium-post-footer&source=post_page-----c448d501a6e2--------------------------------)

## Recommended from Medium

Tatiania Isleana

{UPDATE} 장기도사 Hack Free Resources Generator

Erin M. Nanasi

We’re RICH!

Chris Gebhardt

Penetrating Testing is Dead as We Now Know It


-----