extracting-cobalt-strike-beacon-config

Name: extracting-cobalt-strike-beacon-config
Author: meltedinhex

18stars5forks

How to install extracting-cobalt-strike-beacon-config?

meltedinhex/analyst-ai-pack/extracting-cobalt-strike-beacon-config

$npx -y skills add meltedinhex/analyst-ai-pack --skill extracting-cobalt-strike-beacon-config

Installs into the current project.

Summary

Extracts and interprets a Cobalt Strike Beacon configuration: decoding the

Files · 1

View on GitHub

SKILL.md

1	# Extracting Cobalt Strike Beacon Config
2
3	## When to Use
4
5	- You have a suspected Cobalt Strike Beacon (PE, DLL, shellcode, or extracted blob) and need
6	its configuration.
7	- You want C2 servers, the malleable profile shape, sleep/jitter, watermark, and named pipes.
8	- You are building network IOCs and attribution leads from a beacon.
9
10	Do not use an extracted config alone for hard attribution — watermarks can be shared or
11	cracked. Treat it as one signal among several.
12
13	## Prerequisites
14
15	- The beacon payload (or a memory dump containing it) in neutralized form inside the lab.
16	- Familiarity with Cobalt Strike's encoded config block (commonly XOR-encoded with 0x2e in
17	older versions, 0x69 in others; varies by version).
18
19	## Safety & Handling
20
21	- Static extraction only; do not run the beacon.
22	- Defang recovered C2 hosts/URIs before sharing.
23
24	## Workflow
25
26	### Step 1: Locate the encoded config block
27
28	Beacon stores settings as a packed, XOR-encoded table of TLV-like entries. Brute the
29	single-byte XOR key by scanning for the decoded table's known opening bytes (the first
30	setting index/type/length pattern).
31
32	### Step 2: Decode and parse settings
33
34	Once the key is found, walk the entries. Each has an index (setting type), a type
35	(short/int/string), and a length. The script decodes and maps known indices:
36
37	```bash
38	python scripts/analyst.py parse beacon.bin
39	```
40
41	### Step 3: Recover key fields
42
43	Pull the high-value settings:
44
45	```text
46	C2 servers / GET-URI / POST-URI -> network IOCs
47	User-Agent -> detection signal
48	Sleep time / jitter -> beacon cadence
49	Watermark -> license/team grouping lead
50	Pipe name / process-inject targets -> host IOCs
51	Spawn-to / DNS settings -> behavior
52	```
53
54	### Step 4: Interpret the malleable profile
55
56	The URIs, headers, and transform settings reveal which malleable C2 profile the operator used
57	(e.g. masquerading as a known web service) — useful for network detection.
58
59	### Step 5: Build IOCs
60
61	Emit network IOCs (hosts, URIs, UA), host IOCs (pipe names), and the watermark for tracking.
62
63	## Validation
64
65	- The recovered C2 host(s) and URIs are well-formed and consistent with the profile.
66	- Sleep/jitter values are plausible and match any observed beaconing intervals.
67	- The same config reproduces from an independent extractor or memory copy.
68
69	## Pitfalls
70
71	- Hardcoding one XOR key — it varies across versions; brute-force per sample.
72	- Confusing a watermark match with attribution; cracked/leaked kits share watermarks.
73	- Stopping at the first C2 when the config lists multiple/backup servers.
74
75	## References
76
77	- See [`references/api-reference.md`](references/api-reference.md) for the config parser.
78	- Cobalt Strike malleable C2 docs and community parser concepts (linked in frontmatter).

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

extracting-cobalt-strike-beacon-config

18stars5forks

View on GitHub

How to install extracting-cobalt-strike-beacon-config?

meltedinhex/analyst-ai-pack/extracting-cobalt-strike-beacon-config

$npx -y skills add meltedinhex/analyst-ai-pack --skill extracting-cobalt-strike-beacon-config

Installs into the current project.

Summary

Extracts and interprets a Cobalt Strike Beacon configuration: decoding the

Files · 1

View on GitHub

SKILL.md

1	# Extracting Cobalt Strike Beacon Config
2
3	## When to Use
4
5	- You have a suspected Cobalt Strike Beacon (PE, DLL, shellcode, or extracted blob) and need
6	its configuration.
7	- You want C2 servers, the malleable profile shape, sleep/jitter, watermark, and named pipes.
8	- You are building network IOCs and attribution leads from a beacon.
9
10	Do not use an extracted config alone for hard attribution — watermarks can be shared or
11	cracked. Treat it as one signal among several.
12
13	## Prerequisites
14
15	- The beacon payload (or a memory dump containing it) in neutralized form inside the lab.
16	- Familiarity with Cobalt Strike's encoded config block (commonly XOR-encoded with 0x2e in
17	older versions, 0x69 in others; varies by version).
18
19	## Safety & Handling
20
21	- Static extraction only; do not run the beacon.
22	- Defang recovered C2 hosts/URIs before sharing.
23
24	## Workflow
25
26	### Step 1: Locate the encoded config block
27
28	Beacon stores settings as a packed, XOR-encoded table of TLV-like entries. Brute the
29	single-byte XOR key by scanning for the decoded table's known opening bytes (the first
30	setting index/type/length pattern).
31
32	### Step 2: Decode and parse settings
33
34	Once the key is found, walk the entries. Each has an index (setting type), a type
35	(short/int/string), and a length. The script decodes and maps known indices:
36
37	```bash
38	python scripts/analyst.py parse beacon.bin
39	```
40
41	### Step 3: Recover key fields
42
43	Pull the high-value settings:
44
45	```text
46	C2 servers / GET-URI / POST-URI -> network IOCs
47	User-Agent -> detection signal
48	Sleep time / jitter -> beacon cadence
49	Watermark -> license/team grouping lead
50	Pipe name / process-inject targets -> host IOCs
51	Spawn-to / DNS settings -> behavior
52	```
53
54	### Step 4: Interpret the malleable profile
55
56	The URIs, headers, and transform settings reveal which malleable C2 profile the operator used
57	(e.g. masquerading as a known web service) — useful for network detection.
58
59	### Step 5: Build IOCs
60
61	Emit network IOCs (hosts, URIs, UA), host IOCs (pipe names), and the watermark for tracking.
62
63	## Validation
64
65	- The recovered C2 host(s) and URIs are well-formed and consistent with the profile.
66	- Sleep/jitter values are plausible and match any observed beaconing intervals.
67	- The same config reproduces from an independent extractor or memory copy.
68
69	## Pitfalls
70
71	- Hardcoding one XOR key — it varies across versions; brute-force per sample.
72	- Confusing a watermark match with attribution; cracked/leaked kits share watermarks.
73	- Stopping at the first C2 when the config lists multiple/backup servers.
74
75	## References
76
77	- See [`references/api-reference.md`](references/api-reference.md) for the config parser.
78	- Cobalt Strike malleable C2 docs and community parser concepts (linked in frontmatter).

People who liked this also viewed

6 picks

Type