[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71EZ9KC4T092QRMASGRC8H0":3,"skill-same:01M71EZ9KC4T092QRMASGRC8H0":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":14,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":6,"ownerDescription":49,"updatedAt":50,"install":51,"resources":64},"01M71EZ9KC4T092QRMASGRC8H0","malware-cobaltstrike-malleable",null,"A JSON report containing extracted C2 URIs, HTTP headers, user agents, sleep\u002Fjitter settings, process injection config, spawned process paths, DNS settings, and generated Suricata-compatible detection rules.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-cobaltstrike-malleable\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"malware","malware cobaltstrike malleable","injection","detection","paths","headers","config","c2","settings","report","json","process","jitter","sleep","dns","Rules","cybersecurity","http","generated","suricata","2026-11-10 10:12:30",false,"---\nname: malware-cobaltstrike-malleable\ndescription: \"A JSON report containing extracted C2 URIs, HTTP headers, user agents, sleep\u002Fjitter settings, process injection config, spawned process paths, DNS settings, and generated Suricata-compatible detection rules.\"\ndomain: cybersecurity\n---\n\n# Analyzing CobaltStrike Malleable C2 Profiles\n\n## Overview\n\nCobalt Strike Malleable C2 profiles are domain-specific language scripts that customize how Beacon communicates with the team server, defining HTTP request\u002Fresponse transformations, sleep intervals, jitter values, user agents, URI paths, and process injection behavior. Threat actors use malleable profiles to disguise C2 traffic as legitimate services (Amazon, Google, Slack). Analyzing these profiles reveals network indicators for detection: URI patterns, HTTP headers, POST\u002FGET transforms, DNS settings, and process injection techniques. The `dissect.cobaltstrike` library can parse both profile files and extract configurations from beacon payloads, while `pyMalleableC2` provides AST-based parsing using Lark grammar for programmatic profile manipulation and validation.\n\n## When to Use\n\n- When investigating security incidents that require analyzing cobaltstrike malleable c2 profiles\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `dissect.cobaltstrike` and\u002For `pyMalleableC2`\n- Sample Malleable C2 profiles (available from public repositories)\n- Understanding of HTTP protocol and Cobalt Strike beacon communication model\n- Network monitoring tools (Suricata\u002FSnort) for signature deployment\n- PCAP analysis tools for traffic validation\n\n## Steps\n\n1. Install libraries: `pip install dissect.cobaltstrike` or `pip install pyMalleableC2`\n2. Parse profile with `C2Profile.from_path(\"profile.profile\")`\n3. Extract HTTP GET\u002FPOST block configurations (URIs, headers, parameters)\n4. Identify user agent strings and spoof targets\n5. Extract sleep time, jitter percentage, and DNS beacon settings\n6. Analyze process injection settings (spawn-to, allocation technique)\n7. Generate Suricata\u002FSnort signatures from extracted network indicators\n8. Compare profile against known threat actor profile collections\n9. Extract staging URIs and payload delivery mechanisms\n10. Produce detection report with IOCs and recommended network signatures\n\n## Expected Output\n\nA JSON report containing extracted C2 URIs, HTTP headers, user agents, sleep\u002Fjitter settings, process injection config, spawned process paths, DNS settings, and generated Suricata-compatible detection rules.\n","# Analyzing CobaltStrike Malleable C2 Profiles\n\n## Overview\n\nCobalt Strike Malleable C2 profiles are domain-specific language scripts that customize how Beacon communicates with the team server, defining HTTP request\u002Fresponse transformations, sleep intervals, jitter values, user agents, URI paths, and process injection behavior. Threat actors use malleable profiles to disguise C2 traffic as legitimate services (Amazon, Google, Slack). Analyzing these profiles reveals network indicators for detection: URI patterns, HTTP headers, POST\u002FGET transforms, DNS settings, and process injection techniques. The `dissect.cobaltstrike` library can parse both profile files and extract configurations from beacon payloads, while `pyMalleableC2` provides AST-based parsing using Lark grammar for programmatic profile manipulation and validation.\n\n## When to Use\n\n- When investigating security incidents that require analyzing cobaltstrike malleable c2 profiles\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `dissect.cobaltstrike` and\u002For `pyMalleableC2`\n- Sample Malleable C2 profiles (available from public repositories)\n- Understanding of HTTP protocol and Cobalt Strike beacon communication model\n- Network monitoring tools (Suricata\u002FSnort) for signature deployment\n- PCAP analysis tools for traffic validation\n\n## Steps\n\n1. Install libraries: `pip install dissect.cobaltstrike` or `pip install pyMalleableC2`\n2. Parse profile with `C2Profile.from_path(\"profile.profile\")`\n3. Extract HTTP GET\u002FPOST block configurations (URIs, headers, parameters)\n4. Identify user agent strings and spoof targets\n5. Extract sleep time, jitter percentage, and DNS beacon settings\n6. Analyze process injection settings (spawn-to, allocation technique)\n7. Generate Suricata\u002FSnort signatures from extracted network indicators\n8. Compare profile against known threat actor profile collections\n9. Extract staging URIs and payload delivery mechanisms\n10. Produce detection report with IOCs and recommended network signatures\n\n## Expected Output\n\nA JSON report containing extracted C2 URIs, HTTP headers, user agents, sleep\u002Fjitter settings, process injection config, spawned process paths, DNS settings, and generated Suricata-compatible detection rules.\n",{"name":5,"domain":35,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware-cobaltstrike-malleable","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill malware-cobaltstrike-malleable",{"tool":57,"command":58},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill malware-cobaltstrike-malleable",{"tool":60,"command":61},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill malware-cobaltstrike-malleable","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-cobaltstrike-malleable\u002FSKILL.md",true,[65],{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"index.json","REFERENCE","参考文档",689,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-cobaltstrike-malleable\u002Findex.json",[72,96,119,141,163,178],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[79,80,81,82,83,84,85,30,86,87,88,89,90,91,92,93,94,35,95],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[103,79,104,82,105,106,107,35,108,109,110,111,112,113,84,114,115,116,117,118],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[126,127,128,129,130,131,35,108,132,109,133,134,84,116,135,136,137,138,139,140],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[80,148,149,150,151,152,153,85,154,35,95,155,156,157,158,159,160,161,162,84],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[170,171,80,21,150,152,172,85,173,154,35,95,109,174,175,176,177,162,84,30],"thread","processes thread injection detect","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[185,80,150,186,172,85,187,188,35,95,189,190,191,192,193,194,84,30,195,24],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched"]