Conventionally, Emotet would install either TrickBot or Qbot on compromised devices. These trojans would eventually install Cobalt Strike. Now, it has changed its tactics. click here to read full Article Read more on Malware...
A tool to hunt/mine for Cobalt Strike beacons and “reduce” their beacon configuration for later indexing. Hunts can either be expansive and internet wide using services like SecurityTrails, Shodan, or ZoomEye or a list...
BeaconEye scans running processes for active CobaltStrike beacons. When processes are found to be running beacon, BeaconEye will monitor each process for C2 activity. How it works BeaconEye will scan live processes or MiniDump...
aggrokatz is an Aggressor plugin extension for CobaltStrike which enables pypykatz to interface with the beacons remotely. The current version of aggrokatz allows pypykatz to parse LSASS dump files and Registry hive files to...
PyBeacon is a collection of scripts for dealing with Cobalt Strike’s encrypted traffic. It can encrypt/decrypt beacon metadata, as well as parse symmetric encrypted taskings Scripts included There is a small library which includes...
Scan documents or procedure memory for Cobalt Strike beacons and parse their configuration. CobaltStrikeScan scans Home windows procedure memory for proof of DLL injection (vintage or reflective injection) and performs a YARA scan on...
