Summary
This release updates cobalt_sync to work with the new Cobalt Strike v4.12 and adds functionality to use Ghostwriter's setTags mutation to set tags on log entries.
CHANGELOG
[2.0.5] - 01 December 2025
Changed
- Updated the cobalt_parser to handle new
<task val>fields in Cobalt Strike 4.12 logs - Updated the cobalt_web to create tags in Ghostwriter based on the MITRE fields from Cobalt Strike logs
- Updated the cobalt_web to set the new task identifiers from CS4.12 in the output field in Ghostwriter logs