cobaltstrike-config-extractor

Beacon parser

A toolset to extract and analyze configurations from malware samples known as Cobalt Strike Beacons.

Cobalt Strike Beacon configuration extractor and parser.

GitHub

148 stars
9 watching
11 forks
Language: Python
last commit: over 3 years ago

Related projects:

Repository Description Stars
sentinel-one/cobaltstrikeparser Deciphers CobaltStrike Beacon configurations from various formats. 1,028
fox-it/dissect.cobaltstrike Library for dissecting and parsing data related to Cobalt Strike exploits 148
te-k/cobaltstrike Detects and analyzes Cobalt Strike beacons by analyzing HTTP responses and extracting configuration information. 266
b1tg/cobaltstrike-beacon-rust A Cobalt Strike beacon implementation in Rust for creating malicious network connections 180
fox-it/cobaltstrike-beacon-data Historical metadata of Cobalt Strike Beacon attacks 125
romanemelyanov/cobaltstrikeforensic Toolset to analyze and research malware and Cobalt Strike beacon behavior 206
apr4h/cobaltstrikescan A tool for detecting and parsing CobaltStrike beacon configuration from files or process memory. 902
jamvayne/cobaltstrikedos A Python script to exploit a Cobalt Strike vulnerability and perform a denial of service attack. 103
nexusfuzzy/cobaltspam A tool designed to send fake beacons to a CobaltStrike server as part of a defensive measure 366
splunk/melting-cobalt Tool to hunt and mine Cobalt Strike beacons from internet-connected services 164
z3ratu1/geacon_plus A Go implementation of a CobaltStrike beacon with support for multiple platforms and various communication protocols 397
eremit4/cs-discovery Detects malicious servers in network traffic by analyzing encoded byte patterns 20
wikiz/service_cobaltstrike A CobaltStrike profile repository containing metadata and information about the CobaltStrike malware 39
qigpig/bypass-beacon-config-scan Tools to bypass cobaltstrike beacon config scan vulnerability 84
3lp4tr0n/beaconhunter A tool for detecting and responding to potential Cobalt Strike beacons using Extended Trace Record (ETW) tracing 482