Hands-On Red Team Tactics

Session table

To see the open sessions in a tabular view, click on the button shown in the following screenshot:

All the sessions that are opened in Cobalt Strike will be shown along with the sessions' details. For example, this may include external IP, internal IP, user, computer name, PID into which the session is injected, or last. Last is an element of Cobalt Strike that is similar to WhatsApp's Last Seen feature, showing the last time that the compromised system contacted the team server (in seconds). This is generally used to check when the session was last active:

Right-clicking on one of the sessions gives the user multiple options ...