skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

c2-beacon-analysis

Extract C2 configurations and IOCs from Cobalt Strike, Sliver, and Havoc beacon samples.

1.7k|238|Updated Dec 7, 2019
Search Tags:#threat hunting#malware analysis#memory forensics#cobalt strike#IOC extraction#c2 analysis#beacon config extraction
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill c2-beacon-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: c2-beacon-analysis
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/malware/c2-beacon-analysis
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill c2-beacon-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires dissect.cobaltstrike, and includes references (resource) components.

What problem does it solve?

Analysts who capture C2 beacon samples, memory dumps, or network traffic need a structured way to identify the framework, decrypt embedded configurations, and extract intelligence such as C2 addresses, sleep intervals, watermarks, and named pipes.

Core Features & Use Cases

  • Beacon Type Identification: Classify samples as PE/DLL, shellcode, memory dump, or PCAP traffic and fingerprint the C2 framework via YARA rules and string signatures.
  • Cobalt Strike Config Extraction: Automatically parse configs with dissect.cobaltstrike or manually XOR-decrypt (keys 0x2e/0x69) and parse the TLV structure to recover C2 servers, ports, User-Agents, watermarks, and SpawnTo values.
  • Memory & Traffic Analysis: Scan memory dumps with Volatility3, 1768.py, or BeaconEye, and derive Suricata detection signatures from HTTP/DNS/SMB beacon network patterns.
  • Use Case: Given a suspicious memory dump from an incident, identify it as a Cobalt Strike beacon, decrypt its configuration, extract the C2 domain and watermark, and generate a Suricata rule to detect further callbacks.

Quick Start

Analyze this captured beacon sample to identify the C2 framework and extract its configuration including C2 servers, sleep time, and watermark.

Frequently Asked Questions about c2-beacon-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract a Cobalt Strike beacon configuration?▼

Use the dissect.cobaltstrike Python library's BeaconConfig.from_path() to automatically parse the beacon file and retrieve settings like C2 domains, port, sleep time, jitter, and watermark. If automatic tools fail, manually XOR-decrypt the config blob with keys 0x2e or 0x69 and parse the TLV structure.

How to identify which C2 framework a malware sample uses?▼

Run YARA rules against the sample and inspect strings for framework-specific markers: 'beacon/sleeptime/watermark' indicates Cobalt Strike, 'sliver/implant/mtls' indicates Sliver, and 'havoc/demon/teamserver' indicates Havoc. Go-compiled binaries over 5MB often indicate Sliver implants.

Can I extract beacon configs from a memory dump?▼

Yes, memory dumps can be scanned with Volatility3 combined with YARA rules targeting the encrypted config magic bytes, or with dedicated tools like 1768.py from JPCERT and BeaconEye. Once the config region is located, apply the same XOR decryption and TLV parsing as for file-based samples.

What is a Cobalt Strike watermark and why does it matter?▼

The watermark is a 4-byte integer embedded in every beacon generated from a licensed Cobalt Strike instance, allowing analysts to link samples to a specific license buyer. Cracked versions share known watermarks like 0 or 305419896, so matching watermarks across incidents can attribute activity to the same actor.

What tools detect C2 beaconing in network traffic?▼

RITA analyzes connection intervals and jitter to flag beacon-like periodicity, while JA3/JA3S and JARM fingerprint TLS clients and servers against known C2 profiles. Suricata rules can be generated from extracted beacon URIs, User-Agents, and heartbeat intervals for signature-based detection.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

performing-memory-forensics-with-volatility3-plugins

Automate Volatility3 memory forensics to extract malware indicators from RAM dumps.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

analyzing-network-traffic-of-malware

Analyze malware PCAPs to decode C2 communications and generate Suricata rules.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

analyzing-indicators-of-compromise

Consolidate VirusTotal, AbuseIPDB, and MalwareBazaar results into a unified confidence score and disposition.

Community
Intermediate
bpnrockstarbpnrockstar

malware-analysis

Analyze suspicious binary files with static and dynamic analysis, YARA rules, and MITRE ATT&CK mapping.

Community
Advanced