Behavior:Win32/CobaltStrike

Guidance for end users 

For more tips on how to keep your device safe, go to the Microsoft security help & learning portal (Opens in new window or tab).

To learn more about preventing trojans or other malware from affecting individual devices, read about preventing malware infection (Opens in new window or tab).

Guidance for enterprise administrators 

Ransomware more than often attacks enterprises than individuals. Following the mitigation steps below can help prevent ransomware attacks (use this for enterprise consumer):

• Keep backups so you can recover data affected by ransomware and destructive attacks. Use controlled folder access (Opens in new window or tab) to prevent unauthorized applications from modifying protected files.
• Harden internet-facing assets (Opens in new window or tab) and ensure they have the latest security updates. Use threat and vulnerability management (Opens in new window or tab) to audit these assets regularly for vulnerabilities, misconfigurations, and suspicious activity.
• Secure Remote Desktop Gateway using solutions like Azure Multi-Factor Authentication (MFA). If you don’t have an MFA gateway, enable network-level authentication (NLA). 
• Monitor for brute-force attempts. Check excessive failed authentication attempts (Windows security event ID 4625).
• Turn on cloud-delivered protection (Opens in new window or tab) and automatic sample submission on Microsoft Defender Antivirus. These capabilities use artificial intelligence and machine learning to quickly identify and stop new and unknown threats.
• Turn on attack surface reduction rules (Opens in new window or tab), including rules that block credential theft, ransomware activity, and suspicious use of PsExec and WMI. To address malicious activity initiated through weaponized Office documents, use rules that block advanced macro activity, executable content, process creation, and process injection initiated by Office applications. To assess the impact of these rules, deploy them in audit mode.
• Utilize the Microsoft Defender Firewall (Opens in new window or tab) and your network firewall to prevent RPC and SMB communication among endpoints whenever possible. This limits lateral movement as well as other attack activities.
• Turn on tamper protection (Opens in new window or tab) features to prevent attackers from stopping security services.