beacon-artifact
================

The command ``beacon-artifact`` can be used to dump payloads from executables generated by `ArtifactKit`_.
Usually the artifact executable is a stageless beacon, but it could also contain stager shellcode.

.. _ArtifactKit: https://www.cobaltstrike.com/blog/what-is-a-stageless-payload-artifact/

.. code-block:: bash

   $ beacon-artifact <artifactkit-file> | xxd

The ``beacon-artifact`` tool only dumps the extracted payload (default to stdout).
If the extracted payload is a beacon (stageless artifact) and not a stager, you can pipe the output directly to ``beacon-dump -`` to dump the beacon configuration.

.. code-block:: bash

   $ beacon-artifact <artifactkit-file> | beacon-dump -

If the command is not in your path, you can also run the command using the following Python module:

.. code-block:: bash

   $ python -m dissect.cobaltstrike.artifact --help

.. sphinx_argparse_cli::
  :module: dissect.cobaltstrike.artifact
  :func: main
  :hook:
  :prog: beacon-artifact