Cobalt Strike's built-in socks command creates a SOCKS4a (default) or SOCKS5 listener on the Team Server and relays client traffic through its associated Beacon. Cobalt Strike also documents SOCKS forwarding through an SSH session. This supports network pivoting from the associated session's reachable network position.
RESTRICTED_ACCESS_BLUR_MARKER