about CobaltStrike
Cobalt Strike's Malleable C2 profiles are designed to counter traffic analysis.
Cobalt Strike's Malleable C2 profiles define the "communication format specifications and methods" of C2 traffic between the victim and the team server.
By disguising C2 traffic as "normal traffic", it avoids being directly recognized as abnormal traffic by NIDS/SOC systems, and may confuse security operators.
Details
| Malleable C2 profile | cs version | Description |
|---|---|---|
| jquery.xxx.js_CN_cdn.bootcss.com_for_cs3.14_.txt | 3.12 3.14 | Disguised as normal HTTP traffic: traffic between browser and web server. |
| jquery.xxx.js_code.bootcdn.net_for_cs4.0_.txt | 4.0 | Disguised as normal HTTP traffic: traffic between browser and web server. |
It is recommended to modify the Malleable C2 profile yourself.
AggressorScripts - Modify or extend the client-side functionality of Cobalt Strike 3.* (can implement custom menu creation, logging, privilege persistence, etc.).
For more info, refer to the official introduction: Aggressor Script Tutorial and Reference
Details
Team server logs - folder cobaltstrike/logs/{date}/{ip}
| Log Type | Extension | location |
|---|---|---|
| All Beacon command line content | .log | /cobaltstrike/logs/191107/10.10.13.19/becon_71256.log |
| Screenshot | .jpg | /cobaltstrike/logs/191107/10.10.13.19/screenshots/screen_050658_87924.jpg |
| filename | opsec | Description | demo |
|---|
| BeaconNote.cna | 1 | When a Beacon first comes online, set this Beacon's note to Beacon ID + first online time | bid: 86985 Established: 11/13/2019 16:50:19 (CST) |
| BeaconNotify.cna | 1 | When a Beacon first comes online, send the complete information of this Beacon to the specified Slack Channel Configure your Slack webhooks | host/User/beaconID/os/ver/PID/external IP/internal IP... |
| LoopDo.cna | 0 | Execute an operation every x minutes | Execute on schedule: custom cmd commands / screenshots / logonpasswords /... |
| author/filename | opsec | Description | demo |
|---|
| Cobalt Strike ZeroLogon-BOF | ? | ZeroLogon CVE-2020-1472 | |
| outflanknl/Ps-Tools PS-Tools.cna | ? | List detailed information of processes | 5 commands: psx psk psc psm psh psw |
| https://github.com/rsmudge/ElevateKit | ? | Official recommendation Multiple newer privilege escalation exploits. Version requirement: for Cobalt Strike 3.6 and later. |
