Анализ Cobalt Strike Malleable C2 профилей

★ 8.4 · security

analyzing-cobaltstrike-malleable-c2-profiles is a Claude Code skill that parses and analyzes Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2, extracting HTTP/DNS transforms, URI paths, headers, sleep/jitter settings, and process injection behavior. Malleable profiles are DSL scripts that define how Beacon communicates with its team server; threat actors rely on them to disguise C2 traffic as traffic from legitimate services such as Amazon, Google, or Slack. The skill supports both profile file parsing and configuration extraction from captured beacon payloads, using Lark-grammar-based AST parsing for programmatic manipulation and validation. Output is a JSON report containing extracted IOCs — URIs, user agents, spawned process paths, DNS settings — along with generated Suricata/Snort detection rules. Designed for SOC analysts, threat hunters, and reverse engineers building detections against Cobalt Strike Beacon traffic.