[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ER3SYYQ6XBG9DAED7FVSA4":3,"skill-same:01M6ER3SYYQ6XBG9DAED7FVSA4":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":53,"updatedAt":54,"install":55,"resources":68},"01M6ER3SYYQ6XBG9DAED7FVSA4","analyzing-cobalt-strike-beacon-configuration",null,"Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.","luokai0\u002Fai-agent-skills-by-luo-kai","luokai0","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F266954973?v=4","01M6E16VNT42JB8B3X3254QWJ7","luo kai","01M6E16VTFVP6S5XJF1V1MPV90",14,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-cobalt-strike-beacon-configuration\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"configuration","strike","beacon","analyzing","analyzing cobalt strike beacon configuration","config-extraction","files","analyze","team","analysis","red-team-tools","memory","malware-analysis","c2","cobalt-strike","threat-hunting","red-team","operator","config","cybersecurity","2026-11-10 10:12:30",false,"---\nname: analyzing-cobalt-strike-beacon-configuration\ndescription: Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags: [cobalt-strike, beacon, c2, malware-analysis, config-extraction, threat-hunting, red-team-tools]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Analyzing Cobalt Strike Beacon Configuration\n\n## Overview\n\nCobalt Strike is a commercial adversary simulation tool widely abused by threat actors for post-exploitation operations. Beacon payloads contain embedded configuration data that reveals C2 server addresses, communication protocols, sleep intervals, jitter values, malleable C2 profile settings, watermark identifiers, and encryption keys. Extracting this configuration from PE files, shellcode, or memory dumps is critical for incident responders to map attacker infrastructure and attribute campaigns. The beacon configuration is XOR-encoded using a single byte (0x69 for version 3, 0x2e for version 4) and stored in a Type-Length-Value (TLV) format within the .data section.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing cobalt strike beacon configuration\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `dissect.cobaltstrike`, `pefile`, `yara-python`\n- SentinelOne CobaltStrikeParser (`parse_beacon_config.py`)\n- Hex editor (010 Editor, HxD) for manual inspection\n- Understanding of PE file format and XOR encoding\n- Memory dump acquisition tools (Volatility3, WinDbg)\n- Network analysis tools (Wireshark) for C2 traffic correlation\n\n## Key Concepts\n\n### Beacon Configuration Structure\n\nCobalt Strike beacons store their configuration as a blob of TLV (Type-Length-Value) entries within the .data section of the PE. Stageless beacons XOR the entire beacon code with a 4-byte key. The configuration blob itself uses a single-byte XOR key. Each TLV entry contains a 2-byte type identifier (e.g., 0x0001 for BeaconType, 0x0008 for C2Server), a 2-byte length, and variable-length data.\n\n### Malleable C2 Profiles\n\nThe beacon configuration encodes the malleable C2 profile that dictates HTTP request\u002Fresponse transformations, including URI paths, headers, metadata encoding (Base64, NetBIOS), and data transforms. Analyzing these settings reveals how the beacon disguises its traffic to blend with legitimate web traffic.\n\n### Watermark and License Identification\n\nEach Cobalt Strike license embeds a unique watermark (4-byte integer) into generated beacons. Extracting the watermark can link multiple beacons to the same operator or cracked license. Known watermark databases maintained by threat intelligence providers map watermarks to specific threat actors or leaked license keys.\n\n## Workflow\n\n### Step 1: Extract Configuration with CobaltStrikeParser\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Extract Cobalt Strike beacon config from PE or memory dump.\"\"\"\nimport sys\nimport json\n\n# Using SentinelOne's CobaltStrikeParser\n# pip install dissect.cobaltstrike\nfrom dissect.cobaltstrike.beacon import BeaconConfig\n\ndef extract_beacon_config(filepath):\n    \"\"\"Parse beacon configuration from file.\"\"\"\n    configs = list(BeaconConfig.from_path(filepath))\n\n    if not configs:\n        print(f\"[-] No beacon configuration found in {filepath}\")\n        return None\n\n    for i, config in enumerate(configs):\n        print(f\"\\n[+] Beacon Configuration #{i+1}\")\n        print(f\"{'='*60}\")\n\n        settings = config.as_dict()\n\n        # Critical fields for incident response\n        critical_fields = [\n            \"SETTING_C2_REQUEST\",\n            \"SETTING_C2_RECOVER\",\n            \"SETTING_PUBKEY\",\n            \"SETTING_DOMAINS\",\n            \"SETTING_BEACONTYPE\",\n            \"SETTING_PORT\",\n            \"SETTING_SLEEPTIME\",\n            \"SETTING_JITTER\",\n            \"SETTING_MAXGET\",\n            \"SETTING_SPAWNTO_X86\",\n            \"SETTING_SPAWNTO_X64\",\n            \"SETTING_PIPENAME\",\n            \"SETTING_WATERMARK\",\n            \"SETTING_C2_VERB_GET\",\n            \"SETTING_C2_VERB_POST\",\n            \"SETTING_USERAGENT\",\n            \"SETTING_PROTOCOL\",\n        ]\n\n        for field in critical_fields:\n            value = settings.get(field, \"N\u002FA\")\n            print(f\"  {field}: {value}\")\n\n        return settings\n\n    return None\n\n\ndef extract_c2_indicators(config):\n    \"\"\"Extract actionable C2 indicators from beacon config.\"\"\"\n    indicators = {\n        \"c2_domains\": [],\n        \"c2_ips\": [],\n        \"c2_urls\": [],\n        \"user_agent\": \"\",\n        \"named_pipes\": [],\n        \"spawn_processes\": [],\n        \"watermark\": \"\",\n    }\n\n    if not config:\n        return indicators\n\n    # Extract C2 domains\n    domains = config.get(\"SETTING_DOMAINS\", \"\")\n    if domains:\n        for domain in str(domains).split(\",\"):\n            domain = domain.strip().rstrip(\"\u002F\")\n            if domain:\n                indicators[\"c2_domains\"].append(domain)\n\n    # Extract user agent\n    indicators[\"user_agent\"] = str(config.get(\"SETTING_USERAGENT\", \"\"))\n\n    # Extract named pipes\n    pipe = config.get(\"SETTING_PIPENAME\", \"\")\n    if pipe:\n        indicators[\"named_pipes\"].append(str(pipe))\n\n    # Extract spawn-to processes\n    for arch in [\"SETTING_SPAWNTO_X86\", \"SETTING_SPAWNTO_X64\"]:\n        proc = config.get(arch, \"\")\n        if proc:\n            indicators[\"spawn_processes\"].append(str(proc))\n\n    # Extract watermark\n    indicators[\"watermark\"] = str(config.get(\"SETTING_WATERMARK\", \"\"))\n\n    return indicators\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cbeacon_file_or_dump>\")\n        sys.exit(1)\n\n    config = extract_beacon_config(sys.argv[1])\n    if config:\n        indicators = extract_c2_indicators(config)\n        print(f\"\\n[+] Extracted C2 Indicators:\")\n        print(json.dumps(indicators, indent=2))\n```\n\n### Step 2: Manual XOR Decryption of Beacon Config\n\n```python\nimport struct\n\ndef find_and_decrypt_config(data):\n    \"\"\"Manually locate and decrypt beacon configuration.\"\"\"\n    # Cobalt Strike 4.x uses 0x2e as XOR key\n    xor_keys = [0x2e, 0x69]  # v4, v3\n\n    for xor_key in xor_keys:\n        # Search for the config magic bytes after XOR\n        # Config starts with 0x0001 (BeaconType) XOR'd with key\n        magic = bytes([0x00 ^ xor_key, 0x01 ^ xor_key,\n                       0x00 ^ xor_key, 0x02 ^ xor_key])\n\n        offset = data.find(magic)\n        if offset == -1:\n            continue\n\n        print(f\"[+] Found config at offset 0x{offset:x} (XOR key: 0x{xor_key:02x})\")\n\n        # Decrypt the config blob (typically 4096 bytes)\n        config_size = 4096\n        encrypted = data[offset:offset + config_size]\n        decrypted = bytes([b ^ xor_key for b in encrypted])\n\n        # Parse TLV entries\n        entries = parse_tlv(decrypted)\n        return entries\n\n    return None\n\n\ndef parse_tlv(data):\n    \"\"\"Parse Type-Length-Value configuration entries.\"\"\"\n    entries = {}\n    offset = 0\n\n    # TLV field type mapping\n    field_names = {\n        0x0001: \"BeaconType\",\n        0x0002: \"Port\",\n        0x0003: \"SleepTime\",\n        0x0004: \"MaxGetSize\",\n        0x0005: \"Jitter\",\n        0x0006: \"MaxDNS\",\n        0x0007: \"Deprecated_PublicKey\",\n        0x0008: \"C2Server\",\n        0x0009: \"UserAgent\",\n        0x000a: \"PostURI\",\n        0x000b: \"Malleable_C2_Instructions\",\n        0x000c: \"Deprecated_HttpGet_Metadata\",\n        0x000d: \"SpawnTo_x86\",\n        0x000e: \"SpawnTo_x64\",\n        0x000f: \"CryptoScheme\",\n        0x001a: \"Watermark\",\n        0x001d: \"C2_HostHeader\",\n        0x0024: \"PipeName\",\n        0x0025: \"Year\",\n        0x0026: \"Month\",\n        0x0027: \"Day\",\n        0x0036: \"ProxyHostname\",\n    }\n\n    while offset + 6 \u003C= len(data):\n        entry_type = struct.unpack(\">H\", data[offset:offset+2])[0]\n        entry_len_type = struct.unpack(\">H\", data[offset+2:offset+4])[0]\n        entry_len = struct.unpack(\">H\", data[offset+4:offset+6])[0]\n\n        if entry_type == 0:\n            break\n\n        value_start = offset + 6\n        value_end = value_start + entry_len\n        value_data = data[value_start:value_end]\n\n        field_name = field_names.get(entry_type, f\"Unknown_0x{entry_type:04x}\")\n\n        if entry_len_type == 1:  # Short\n            value = struct.unpack(\">H\", value_data[:2])[0]\n        elif entry_len_type == 2:  # Int\n            value = struct.unpack(\">I\", value_data[:4])[0]\n        elif entry_len_type == 3:  # String\u002FBlob\n            value = value_data.rstrip(b'\\x00').decode('utf-8', errors='replace')\n        else:\n            value = value_data.hex()\n\n        entries[field_name] = value\n        print(f\"  {field_name}: {value}\")\n\n        offset = value_end\n\n    return entries\n```\n\n### Step 3: YARA Rule for Beacon Detection\n\n```python\nimport yara\n\ncobalt_strike_rule = \"\"\"\nrule CobaltStrike_Beacon_Config {\n    meta:\n        description = \"Detects Cobalt Strike beacon configuration\"\n        author = \"Malware Analysis Team\"\n        date = \"2025-01-01\"\n\n    strings:\n        \u002F\u002F XOR'd config marker for CS 4.x (key 0x2e)\n        $config_v4 = { 2e 2f 2e 2c }\n\n        \u002F\u002F XOR'd config marker for CS 3.x (key 0x69)\n        $config_v3 = { 69 68 69 6b }\n\n        \u002F\u002F Common beacon strings\n        $str_pipe = \"\\\\\\\\.\\\\pipe\\\\\" ascii wide\n        $str_beacon = \"beacon\" ascii nocase\n        $str_sleeptime = \"sleeptime\" ascii nocase\n\n        \u002F\u002F Reflective loader pattern\n        $reflective = { 4D 5A 41 52 55 48 89 E5 }\n\n    condition:\n        ($config_v4 or $config_v3) or\n        (2 of ($str_*) and $reflective)\n}\n\"\"\"\n\ndef scan_for_beacons(filepath):\n    \"\"\"Scan file with YARA rules for Cobalt Strike beacons.\"\"\"\n    rules = yara.compile(source=cobalt_strike_rule)\n    matches = rules.match(filepath)\n\n    for match in matches:\n        print(f\"[+] YARA Match: {match.rule}\")\n        for string_match in match.strings:\n            offset = string_match.instances[0].offset\n            print(f\"    String: {string_match.identifier} at offset 0x{offset:x}\")\n\n    return matches\n```\n\n### Step 4: Network Traffic Correlation\n\n```python\nfrom dissect.cobaltstrike.c2 import HttpC2Config\n\ndef analyze_c2_profile(beacon_config):\n    \"\"\"Analyze malleable C2 profile from beacon configuration.\"\"\"\n    print(\"\\n[+] Malleable C2 Profile Analysis\")\n    print(\"=\" * 60)\n\n    # HTTP GET configuration\n    get_verb = beacon_config.get(\"SETTING_C2_VERB_GET\", \"GET\")\n    get_uri = beacon_config.get(\"SETTING_C2_REQUEST\", \"\")\n    print(f\"\\n  HTTP GET Request:\")\n    print(f\"    Verb: {get_verb}\")\n    print(f\"    URI: {get_uri}\")\n\n    # HTTP POST configuration\n    post_verb = beacon_config.get(\"SETTING_C2_VERB_POST\", \"POST\")\n    post_uri = beacon_config.get(\"SETTING_C2_POSTREQ\", \"\")\n    print(f\"\\n  HTTP POST Request:\")\n    print(f\"    Verb: {post_verb}\")\n    print(f\"    URI: {post_uri}\")\n\n    # User Agent\n    ua = beacon_config.get(\"SETTING_USERAGENT\", \"\")\n    print(f\"\\n  User-Agent: {ua}\")\n\n    # Host header\n    host = beacon_config.get(\"SETTING_C2_HOSTHEADER\", \"\")\n    print(f\"  Host Header: {host}\")\n\n    # Sleep and jitter for traffic pattern\n    sleep_ms = beacon_config.get(\"SETTING_SLEEPTIME\", 60000)\n    jitter = beacon_config.get(\"SETTING_JITTER\", 0)\n    print(f\"\\n  Sleep Time: {sleep_ms}ms\")\n    print(f\"  Jitter: {jitter}%\")\n\n    # Generate Suricata\u002FSnort signatures\n    print(f\"\\n[+] Suggested Network Signatures:\")\n    if ua:\n        print(f'  alert http any any -> any any (msg:\"CS Beacon UA\"; '\n              f'content:\"{ua}\"; http_user_agent; sid:1000001; rev:1;)')\n    if get_uri:\n        print(f'  alert http any any -> any any (msg:\"CS Beacon URI\"; '\n              f'content:\"{get_uri}\"; http_uri; sid:1000002; rev:1;)')\n```\n\n## Validation Criteria\n\n- Beacon configuration successfully extracted from PE file or memory dump\n- C2 server domains\u002FIPs correctly identified with port and protocol\n- Malleable C2 profile parameters decoded showing HTTP transforms\n- Watermark value extracted for attribution correlation\n- Sleep time and jitter values match observed network beacon intervals\n- YARA rules detect beacon in both packed and unpacked samples\n- Network signatures generated from extracted C2 profile\n\n## References\n\n- [SentinelOne CobaltStrikeParser](https:\u002F\u002Fgithub.com\u002FSentinel-One\u002FCobaltStrikeParser)\n- [dissect.cobaltstrike Library](https:\u002F\u002Fgithub.com\u002Ffox-it\u002Fdissect.cobaltstrike)\n- [SentinelLabs Beacon Configuration Analysis](https:\u002F\u002Fwww.sentinelone.com\u002Flabs\u002Fthe-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration\u002F)\n- [Cobalt Strike Staging and Config Extraction](https:\u002F\u002Fblog.securehat.co.uk\u002Fcobaltstrike\u002Fextracting-config-from-cobaltstrike-stager-shellcode)\n- [MITRE ATT&CK - Cobalt Strike S0154](https:\u002F\u002Fattack.mitre.org\u002Fsoftware\u002FS0154\u002F)\n","# Analyzing Cobalt Strike Beacon Configuration\n\n## Overview\n\nCobalt Strike is a commercial adversary simulation tool widely abused by threat actors for post-exploitation operations. Beacon payloads contain embedded configuration data that reveals C2 server addresses, communication protocols, sleep intervals, jitter values, malleable C2 profile settings, watermark identifiers, and encryption keys. Extracting this configuration from PE files, shellcode, or memory dumps is critical for incident responders to map attacker infrastructure and attribute campaigns. The beacon configuration is XOR-encoded using a single byte (0x69 for version 3, 0x2e for version 4) and stored in a Type-Length-Value (TLV) format within the .data section.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing cobalt strike beacon configuration\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `dissect.cobaltstrike`, `pefile`, `yara-python`\n- SentinelOne CobaltStrikeParser (`parse_beacon_config.py`)\n- Hex editor (010 Editor, HxD) for manual inspection\n- Understanding of PE file format and XOR encoding\n- Memory dump acquisition tools (Volatility3, WinDbg)\n- Network analysis tools (Wireshark) for C2 traffic correlation\n\n## Key Concepts\n\n### Beacon Configuration Structure\n\nCobalt Strike beacons store their configuration as a blob of TLV (Type-Length-Value) entries within the .data section of the PE. Stageless beacons XOR the entire beacon code with a 4-byte key. The configuration blob itself uses a single-byte XOR key. Each TLV entry contains a 2-byte type identifier (e.g., 0x0001 for BeaconType, 0x0008 for C2Server), a 2-byte length, and variable-length data.\n\n### Malleable C2 Profiles\n\nThe beacon configuration encodes the malleable C2 profile that dictates HTTP request\u002Fresponse transformations, including URI paths, headers, metadata encoding (Base64, NetBIOS), and data transforms. Analyzing these settings reveals how the beacon disguises its traffic to blend with legitimate web traffic.\n\n### Watermark and License Identification\n\nEach Cobalt Strike license embeds a unique watermark (4-byte integer) into generated beacons. Extracting the watermark can link multiple beacons to the same operator or cracked license. Known watermark databases maintained by threat intelligence providers map watermarks to specific threat actors or leaked license keys.\n\n## Workflow\n\n### Step 1: Extract Configuration with CobaltStrikeParser\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Extract Cobalt Strike beacon config from PE or memory dump.\"\"\"\nimport sys\nimport json\n\n# Using SentinelOne's CobaltStrikeParser\n# pip install dissect.cobaltstrike\nfrom dissect.cobaltstrike.beacon import BeaconConfig\n\ndef extract_beacon_config(filepath):\n    \"\"\"Parse beacon configuration from file.\"\"\"\n    configs = list(BeaconConfig.from_path(filepath))\n\n    if not configs:\n        print(f\"[-] No beacon configuration found in {filepath}\")\n        return None\n\n    for i, config in enumerate(configs):\n        print(f\"\\n[+] Beacon Configuration #{i+1}\")\n        print(f\"{'='*60}\")\n\n        settings = config.as_dict()\n\n        # Critical fields for incident response\n        critical_fields = [\n            \"SETTING_C2_REQUEST\",\n            \"SETTING_C2_RECOVER\",\n            \"SETTING_PUBKEY\",\n            \"SETTING_DOMAINS\",\n            \"SETTING_BEACONTYPE\",\n            \"SETTING_PORT\",\n            \"SETTING_SLEEPTIME\",\n            \"SETTING_JITTER\",\n            \"SETTING_MAXGET\",\n            \"SETTING_SPAWNTO_X86\",\n            \"SETTING_SPAWNTO_X64\",\n            \"SETTING_PIPENAME\",\n            \"SETTING_WATERMARK\",\n            \"SETTING_C2_VERB_GET\",\n            \"SETTING_C2_VERB_POST\",\n            \"SETTING_USERAGENT\",\n            \"SETTING_PROTOCOL\",\n        ]\n\n        for field in critical_fields:\n            value = settings.get(field, \"N\u002FA\")\n            print(f\"  {field}: {value}\")\n\n        return settings\n\n    return None\n\n\ndef extract_c2_indicators(config):\n    \"\"\"Extract actionable C2 indicators from beacon config.\"\"\"\n    indicators = {\n        \"c2_domains\": [],\n        \"c2_ips\": [],\n        \"c2_urls\": [],\n        \"user_agent\": \"\",\n        \"named_pipes\": [],\n        \"spawn_processes\": [],\n        \"watermark\": \"\",\n    }\n\n    if not config:\n        return indicators\n\n    # Extract C2 domains\n    domains = config.get(\"SETTING_DOMAINS\", \"\")\n    if domains:\n        for domain in str(domains).split(\",\"):\n            domain = domain.strip().rstrip(\"\u002F\")\n            if domain:\n                indicators[\"c2_domains\"].append(domain)\n\n    # Extract user agent\n    indicators[\"user_agent\"] = str(config.get(\"SETTING_USERAGENT\", \"\"))\n\n    # Extract named pipes\n    pipe = config.get(\"SETTING_PIPENAME\", \"\")\n    if pipe:\n        indicators[\"named_pipes\"].append(str(pipe))\n\n    # Extract spawn-to processes\n    for arch in [\"SETTING_SPAWNTO_X86\", \"SETTING_SPAWNTO_X64\"]:\n        proc = config.get(arch, \"\")\n        if proc:\n            indicators[\"spawn_processes\"].append(str(proc))\n\n    # Extract watermark\n    indicators[\"watermark\"] = str(config.get(\"SETTING_WATERMARK\", \"\"))\n\n    return indicators\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cbeacon_file_or_dump>\")\n        sys.exit(1)\n\n    config = extract_beacon_config(sys.argv[1])\n    if config:\n        indicators = extract_c2_indicators(config)\n        print(f\"\\n[+] Extracted C2 Indicators:\")\n        print(json.dumps(indicators, indent=2))\n```\n\n### Step 2: Manual XOR Decryption of Beacon Config\n\n```python\nimport struct\n\ndef find_and_decrypt_config(data):\n    \"\"\"Manually locate and decrypt beacon configuration.\"\"\"\n    # Cobalt Strike 4.x uses 0x2e as XOR key\n    xor_keys = [0x2e, 0x69]  # v4, v3\n\n    for xor_key in xor_keys:\n        # Search for the config magic bytes after XOR\n        # Config starts with 0x0001 (BeaconType) XOR'd with key\n        magic = bytes([0x00 ^ xor_key, 0x01 ^ xor_key,\n                       0x00 ^ xor_key, 0x02 ^ xor_key])\n\n        offset = data.find(magic)\n        if offset == -1:\n            continue\n\n        print(f\"[+] Found config at offset 0x{offset:x} (XOR key: 0x{xor_key:02x})\")\n\n        # Decrypt the config blob (typically 4096 bytes)\n        config_size = 4096\n        encrypted = data[offset:offset + config_size]\n        decrypted = bytes([b ^ xor_key for b in encrypted])\n\n        # Parse TLV entries\n        entries = parse_tlv(decrypted)\n        return entries\n\n    return None\n\n\ndef parse_tlv(data):\n    \"\"\"Parse Type-Length-Value configuration entries.\"\"\"\n    entries = {}\n    offset = 0\n\n    # TLV field type mapping\n    field_names = {\n        0x0001: \"BeaconType\",\n        0x0002: \"Port\",\n        0x0003: \"SleepTime\",\n        0x0004: \"MaxGetSize\",\n        0x0005: \"Jitter\",\n        0x0006: \"MaxDNS\",\n        0x0007: \"Deprecated_PublicKey\",\n        0x0008: \"C2Server\",\n        0x0009: \"UserAgent\",\n        0x000a: \"PostURI\",\n        0x000b: \"Malleable_C2_Instructions\",\n        0x000c: \"Deprecated_HttpGet_Metadata\",\n        0x000d: \"SpawnTo_x86\",\n        0x000e: \"SpawnTo_x64\",\n        0x000f: \"CryptoScheme\",\n        0x001a: \"Watermark\",\n        0x001d: \"C2_HostHeader\",\n        0x0024: \"PipeName\",\n        0x0025: \"Year\",\n        0x0026: \"Month\",\n        0x0027: \"Day\",\n        0x0036: \"ProxyHostname\",\n    }\n\n    while offset + 6 \u003C= len(data):\n        entry_type = struct.unpack(\">H\", data[offset:offset+2])[0]\n        entry_len_type = struct.unpack(\">H\", data[offset+2:offset+4])[0]\n        entry_len = struct.unpack(\">H\", data[offset+4:offset+6])[0]\n\n        if entry_type == 0:\n            break\n\n        value_start = offset + 6\n        value_end = value_start + entry_len\n        value_data = data[value_start:value_end]\n\n        field_name = field_names.get(entry_type, f\"Unknown_0x{entry_type:04x}\")\n\n        if entry_len_type == 1:  # Short\n            value = struct.unpack(\">H\", value_data[:2])[0]\n        elif entry_len_type == 2:  # Int\n            value = struct.unpack(\">I\", value_data[:4])[0]\n        elif entry_len_type == 3:  # String\u002FBlob\n            value = value_data.rstrip(b'\\x00').decode('utf-8', errors='replace')\n        else:\n            value = value_data.hex()\n\n        entries[field_name] = value\n        print(f\"  {field_name}: {value}\")\n\n        offset = value_end\n\n    return entries\n```\n\n### Step 3: YARA Rule for Beacon Detection\n\n```python\nimport yara\n\ncobalt_strike_rule = \"\"\"\nrule CobaltStrike_Beacon_Config {\n    meta:\n        description = \"Detects Cobalt Strike beacon configuration\"\n        author = \"Malware Analysis Team\"\n        date = \"2025-01-01\"\n\n    strings:\n        \u002F\u002F XOR'd config marker for CS 4.x (key 0x2e)\n        $config_v4 = { 2e 2f 2e 2c }\n\n        \u002F\u002F XOR'd config marker for CS 3.x (key 0x69)\n        $config_v3 = { 69 68 69 6b }\n\n        \u002F\u002F Common beacon strings\n        $str_pipe = \"\\\\\\\\.\\\\pipe\\\\\" ascii wide\n        $str_beacon = \"beacon\" ascii nocase\n        $str_sleeptime = \"sleeptime\" ascii nocase\n\n        \u002F\u002F Reflective loader pattern\n        $reflective = { 4D 5A 41 52 55 48 89 E5 }\n\n    condition:\n        ($config_v4 or $config_v3) or\n        (2 of ($str_*) and $reflective)\n}\n\"\"\"\n\ndef scan_for_beacons(filepath):\n    \"\"\"Scan file with YARA rules for Cobalt Strike beacons.\"\"\"\n    rules = yara.compile(source=cobalt_strike_rule)\n    matches = rules.match(filepath)\n\n    for match in matches:\n        print(f\"[+] YARA Match: {match.rule}\")\n        for string_match in match.strings:\n            offset = string_match.instances[0].offset\n            print(f\"    String: {string_match.identifier} at offset 0x{offset:x}\")\n\n    return matches\n```\n\n### Step 4: Network Traffic Correlation\n\n```python\nfrom dissect.cobaltstrike.c2 import HttpC2Config\n\ndef analyze_c2_profile(beacon_config):\n    \"\"\"Analyze malleable C2 profile from beacon configuration.\"\"\"\n    print(\"\\n[+] Malleable C2 Profile Analysis\")\n    print(\"=\" * 60)\n\n    # HTTP GET configuration\n    get_verb = beacon_config.get(\"SETTING_C2_VERB_GET\", \"GET\")\n    get_uri = beacon_config.get(\"SETTING_C2_REQUEST\", \"\")\n    print(f\"\\n  HTTP GET Request:\")\n    print(f\"    Verb: {get_verb}\")\n    print(f\"    URI: {get_uri}\")\n\n    # HTTP POST configuration\n    post_verb = beacon_config.get(\"SETTING_C2_VERB_POST\", \"POST\")\n    post_uri = beacon_config.get(\"SETTING_C2_POSTREQ\", \"\")\n    print(f\"\\n  HTTP POST Request:\")\n    print(f\"    Verb: {post_verb}\")\n    print(f\"    URI: {post_uri}\")\n\n    # User Agent\n    ua = beacon_config.get(\"SETTING_USERAGENT\", \"\")\n    print(f\"\\n  User-Agent: {ua}\")\n\n    # Host header\n    host = beacon_config.get(\"SETTING_C2_HOSTHEADER\", \"\")\n    print(f\"  Host Header: {host}\")\n\n    # Sleep and jitter for traffic pattern\n    sleep_ms = beacon_config.get(\"SETTING_SLEEPTIME\", 60000)\n    jitter = beacon_config.get(\"SETTING_JITTER\", 0)\n    print(f\"\\n  Sleep Time: {sleep_ms}ms\")\n    print(f\"  Jitter: {jitter}%\")\n\n    # Generate Suricata\u002FSnort signatures\n    print(f\"\\n[+] Suggested Network Signatures:\")\n    if ua:\n        print(f'  alert http any any -> any any (msg:\"CS Beacon UA\"; '\n              f'content:\"{ua}\"; http_user_agent; sid:1000001; rev:1;)')\n    if get_uri:\n        print(f'  alert http any any -> any any (msg:\"CS Beacon URI\"; '\n              f'content:\"{get_uri}\"; http_uri; sid:1000002; rev:1;)')\n```\n\n## Validation Criteria\n\n- Beacon configuration successfully extracted from PE file or memory dump\n- C2 server domains\u002FIPs correctly identified with port and protocol\n- Malleable C2 profile parameters decoded showing HTTP transforms\n- Watermark value extracted for attribution correlation\n- Sleep time and jitter values match observed network beacon intervals\n- YARA rules detect beacon in both packed and unpacked samples\n- Network signatures generated from extracted C2 profile\n\n## References\n\n- [SentinelOne CobaltStrikeParser](https:\u002F\u002Fgithub.com\u002FSentinel-One\u002FCobaltStrikeParser)\n- [dissect.cobaltstrike Library](https:\u002F\u002Fgithub.com\u002Ffox-it\u002Fdissect.cobaltstrike)\n- [SentinelLabs Beacon Configuration Analysis](https:\u002F\u002Fwww.sentinelone.com\u002Flabs\u002Fthe-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration\u002F)\n- [Cobalt Strike Staging and Config Extraction](https:\u002F\u002Fblog.securehat.co.uk\u002Fcobaltstrike\u002Fextracting-config-from-cobaltstrike-stager-shellcode)\n- [MITRE ATT&CK - Cobalt Strike S0154](https:\u002F\u002Fattack.mitre.org\u002Fsoftware\u002FS0154\u002F)\n",{"name":5,"tags":44,"author":45,"domain":38,"license":15,"version":46,"subdomain":31,"description":7},[33,21,32,31,24,34,29],"mahipal","1.0","main","4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c","ai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-cobalt-strike-beacon-configuration",2,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai","https:\u002F\u002Fgithub.com\u002Fluokai0","a solo builder.","2026-05-06 04:29:04",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill analyzing-cobalt-strike-beacon-configuration",{"tool":61,"command":62},"bunx","bunx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill analyzing-cobalt-strike-beacon-configuration",{"tool":64,"command":65},"pnpm","pnpm dlx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill analyzing-cobalt-strike-beacon-configuration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-cobalt-strike-beacon-configuration\u002FSKILL.md",true,[69,75,80,86,90,94,100],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"assets\u002Ftemplate.md","ASSET","资产文件",2198,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-cobalt-strike-beacon-configuration\u002Fassets\u002Ftemplate.md",{"path":76,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-cobalt-strike-beacon-configuration\u002FLICENSE",{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"references\u002Fapi-reference.md","REFERENCE","参考文档",3015,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-cobalt-strike-beacon-configuration\u002Freferences\u002Fapi-reference.md",{"path":87,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fstandards.md",3006,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-cobalt-strike-beacon-configuration\u002Freferences\u002Fstandards.md",{"path":91,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fworkflows.md",3618,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-cobalt-strike-beacon-configuration\u002Freferences\u002Fworkflows.md",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"scripts\u002Fagent.py","SCRIPT","脚本",8405,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-cobalt-strike-beacon-configuration\u002Fscripts\u002Fagent.py",{"path":101,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fprocess.py",10620,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-cobalt-strike-beacon-configuration\u002Fscripts\u002Fprocess.py",[105,133,150,180,213,250],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":109,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":39},"01M6F2SKTE208174C7S7JJCZC7","write-contracts","Generates secure Aptos Move V2 smart contracts with Object model, Digital Asset integration, security patterns, and storage type guidance. Includes comprehensive storage decision framework for optimal data structure selection. Triggers on: 'write contract', 'create NFT collection', 'build marketplace', 'implement minting', 'generate Move module', 'create token contract', 'build DAO', 'implement staking'. Ask storage questions when: 'store', 'track', 'registry', 'mapping', 'list', 'collection'.","MIT","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fwrite-contracts\u002FSKILL.md",[],[113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132],"write","contracts","write contracts","storage","secure","create","generate","collection","model","decision","ask","smart-contracts","selection","objects","structure","nft","token","aptos","critical","move",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":109,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":39},"01M6F2RFXJ6T9MKW0A7N7GM45B","web-search","通用网络搜索技能，支持多引擎搜索（百度、必应、DuckDuckGo），无需API密钥即可获取实时信息","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fweb-search-ex-skill\u002FSKILL.md",[],[140,141,142,143,144,145,146,147,148,149],"web","search","web search","搜索","baidu","bing","duckduckgo","百度","多引擎","internet",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":109,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":161,"publishedAt":39},"01M6F2K968G1FZEZFPW2E6B222","solo-build","Execute implementation plan tasks with TDD workflow, auto-commit, and phase gates. Use when user says \"build it\", \"start building\", \"execute plan\", \"implement tasks\", \"ship it\", or references a track ID. Do NOT use for planning (use \u002Fplan) or scaffolding (use \u002Fscaffold).","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fsolo-build\u002FSKILL.md",[156],{"categoryNo":157,"categoryName":158,"taxonomyType":159,"taxonomyTypeDesc":160},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[162,163,164,165,166,167,168,169,141,170,171,172,113,173,174,175,176,177,178,179],"build","solo","solo build","MCP","workflow","commit","tasks","code","Bash","plan","read","auto","references","context7","query","scaffolding","ship it","project",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":109,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":192,"publishedAt":39},"01M6F2GKN39SGHSPWYB3662YC8","react-email","Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering emails to HTML, or sending emails with Resend. Covers welcome emails, password resets, notifications, order confirmations, newsletters, transactional emails, and the embeddable email editor component.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Freact-email-skills\u002FSKILL.md",[186,189],{"categoryNo":187,"categoryName":188,"taxonomyType":159,"taxonomyTypeDesc":160},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":190,"categoryName":191,"taxonomyType":159,"taxonomyTypeDesc":160},"01JBSEEDCAT000000000000009","前端开发",[193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212],"react","email","react email","github","editor","components","react components","component","welcome","https","notifications","password","node","use","html","resend","visual","emails","rendering","with",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":109,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":231,"publishedAt":39},"01M6F2FBVGVDFSG8SSFJGXA40C","APITester Agent-Driven API Testing","Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fopenclaw-api-tester\u002FSKILL.md",[219,222,225,226],{"categoryNo":220,"categoryName":221,"taxonomyType":159,"taxonomyTypeDesc":160},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":223,"categoryName":224,"taxonomyType":159,"taxonomyTypeDesc":160},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":157,"categoryName":158,"taxonomyType":159,"taxonomyTypeDesc":160},{"categoryNo":227,"categoryName":228,"taxonomyType":229,"taxonomyTypeDesc":230},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249],"testing","api","api testing","driven","APITester Agent Driven API Testing","test","run","postman","results","plain english","tester","endpoints","document","get","define","tests","english","api-tester",{"skillNo":251,"name":252,"nameZh":6,"description":253,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":109,"licenseFileUrl":6,"sourceHtmlUrl":254,"categories":255,"keywords":256,"publishedAt":39},"01M6F273Y3NGAPVJZ608BC0G9G","hubspot-implementation-plan","Generate a phased implementation plan from a HubSpot audit report. Creates prioritized, sequenced cleanup processes with effort estimates, dependencies, and automation feasibility. Use after running \u002Fhubspot-audit.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fhubspot-implementation-plan\u002FSKILL.md",[],[171,257,258,259,260,261,262,119,263,264,265,266,267,206,268,269,212,270],"implementation","hubspot","hubspot implementation plan","automation","feasibility","cleanup","planning","report","audit","audit report","phased implementation","dependencies","processes","hubspot audit"]