Анализ конфигурации Cobalt Strike Beacon

★ 8.4 · security

analyzing-cobalt-strike-beacon-configuration is a Claude Code skill that extracts and analyzes Cobalt Strike Beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable C2 profiles, and operator tradecraft. Beacon configs are stored as TLV-encoded blobs in the PE .data section, XOR-encrypted with a single byte (0x69 for version 3, 0x2e for version 4); the skill parses them using dissect.cobaltstrike alongside pefile and yara-python. Key fields surfaced include C2 domains, HTTP verbs, User-Agent strings, sleep and jitter timings, named pipes, spawn-to processes, and the 4-byte license watermark that can link separate beacons to the same operator or leaked license key. Designed for incident responders and SOC analysts, it accelerates campaign attribution, detection rule development, and security monitoring validation against MITRE ATT&CK techniques T1071.001, T1573.001, T1090.004, and T1105.