BPFDoor Scanner
Python script to identify hosts infected with the BPFDoor malware.
Cobalt Strike Beacon Extractor
Python script that collects Cobalt Strike memory data generated by security events from an Elasticsearch cluster, extracts the configuration from the CS beacon, and writes the data back to Elasticsearch.
EMOTET Configuration Extractor
Python script to extract the configuration from EMOTET samples.
BLISTER Configuration Extractor
Python script to extract the configuration and payload from BLISTER samples.
EMOTET Dynamic Configuration Extraction
Elastic Security Labs discusses the EMOTET trojan and is releasing a tool to dynamically extract configuration files using code emulators.
Handy Elastic Tools for the Enthusiastic Detection Engineer
Tools like the EQLPlaygound, RTAs, and detection-rules CLI are great resources for getting started with EQL, threat hunting, and detection engineering respectively.
Extracting Cobalt Strike Beacon Configurations
Part 2 - Extracting configurations from Cobalt Strike implant beacons.