Python parser for CobaltStrike Beacon’s configuration Description Use parse_beacon_config.py for stageless beacons, memory dumps or C2 urls with metasploit compatibility mode (default true). Many stageless beacons are PEs where the beacon code itself is...
BeaconEye scans running processes for active CobaltStrike beacons. When processes are found to be running beacon, BeaconEye will monitor each process for C2 activity. How it works BeaconEye will scan live processes or MiniDump...
RedWarden – Flexible CobaltStrike Malleable Redirector (previously known as proxy2’s malleable_redirector plugin) Let’s raise the bar in C2 redirectors IR resiliency, shall we? Red Teaming business has seen several different great ideas on how...
Scan documents or procedure memory for Cobalt Strike beacons and parse their configuration. CobaltStrikeScan scans Home windows procedure memory for proof of DLL injection (vintage or reflective injection) and performs a YARA scan on...
