analyzing-cobalt-strike-beacon-configuration

This Skill analyzes PE files, shellcode, and memory dumps to extract the Cobalt Strike beacon configuration. It decodes TLV fields to reveal C2 servers, sleep intervals, watermarks, and malleable C2 profiles for incident response and threat hunting.

The best way to parse beacon TLV fields for threat intel is using the dissect.cobaltstrike library or a manual XOR parser. This Skill decodes TLV structures to enumerate C2 servers, ports, watermarks, and malleable C2 profiles from beacon samples.

Yes, you can analyze shellcode to map Cobalt Strike C2 infrastructure. This Skill supports extracting beacon configurations from shellcode, PE files, and memory dumps to reveal C2 servers, ports, and malleable C2 profiles for threat hunting.

Yes, this beacon analysis approach works with PE files and shellcode. The Skill extracts Cobalt Strike beacon configurations from PE files, shellcode, and memory dumps using the dissect.cobaltstrike library or a manual XOR parser to output structured IOCs.

To generate IOCs from a Cobalt Strike beacon sample, this Skill extracts and decodes TLV fields to produce a structured IOC list. It outputs indicators including domains, IPs, URIs, and named pipes for threat intelligence reporting.

You do not strictly need dissect.cobaltstrike to extract malleable C2 profiles, as this Skill supports a manual XOR parser as an alternative. However, the dissect.cobaltstrike library is a core dependency for structured TLV extraction and reporting.