cobaltstrike-config-extractor

Beacon parser

A toolset to extract and analyze configurations from malware samples known as Cobalt Strike Beacons.

Cobalt Strike Beacon configuration extractor and parser.

GitHub

145 stars
9 watching
11 forks
Language: Python
last commit: about 3 years ago

Related projects:

Repository Description Stars
sentinel-one/cobaltstrikeparser Deciphers CobaltStrike Beacon configurations from various formats. 1,022
fox-it/dissect.cobaltstrike Library for dissecting and parsing data related to Cobalt Strike exploits 147
te-k/cobaltstrike Detects and analyzes Cobalt Strike beacons by analyzing HTTP responses and extracting configuration information. 262
b1tg/cobaltstrike-beacon-rust A Cobalt Strike beacon implementation in Rust for creating malicious network connections 177
fox-it/cobaltstrike-beacon-data Historical metadata of Cobalt Strike Beacon attacks 122
romanemelyanov/cobaltstrikeforensic Toolset to analyze and research malware and Cobalt Strike beacon behavior 206
apr4h/cobaltstrikescan A tool for detecting and parsing CobaltStrike beacon configuration from files or process memory. 900
jamvayne/cobaltstrikedos A Python script to exploit a Cobalt Strike vulnerability and perform a denial of service attack. 103
nexusfuzzy/cobaltspam A tool designed to send fake beacons to a CobaltStrike server as part of a defensive measure 367
splunk/melting-cobalt Tool to hunt and mine Cobalt Strike beacons from internet-connected services 164
z3ratu1/geacon_plus A Go implementation of a CobaltStrike beacon with support for multiple platforms and various communication protocols 394
eremit4/cs-discovery Detects malicious servers in network traffic by analyzing encoded byte patterns 20
wikiz/service_cobaltstrike A CobaltStrike profile repository containing metadata and information about the CobaltStrike malware 39
qigpig/bypass-beacon-config-scan Tools to bypass cobaltstrike beacon config scan vulnerability 84
3lp4tr0n/beaconhunter A tool for detecting and responding to potential Cobalt Strike beacons using Extended Trace Record (ETW) tracing 481