Blog
Cobalt Strike beacons
Pull Cobalt Strike beacons out of endpoint memory with Fleet, extract their Malleable C2 configurations, and index them back into Elasticsearch with a Python tool.
Collecting Cobalt Strike Beacons with the Elastic Stack
Security Labs
Collecting Cobalt Strike Beacons with the Elastic Stack
Part 1 - Processes and technology needed to extract Cobalt Strike implant beacons
Extracting Cobalt Strike Beacon Configurations
Security Labs
Extracting Cobalt Strike Beacon Configurations
Part 2 - Extracting configurations from Cobalt Strike implant beacons.
Cobalt Strike Beacon Extractor
Security Labs
Cobalt Strike Beacon Extractor
Python script that collects Cobalt Strike memory data generated by security events from an Elasticsearch cluster, extracts the configuration from the CS beacon, and writes the data back to Elasticsearch.