dissect.cobaltstrike.guardrails.C_GUARDRAILS_DEF

Structures for parsing Beacon Guardrails metadata.

enum GuardOption: uint16 {
    GUARD_USER = 5,
    GUARD_COMPUTER = 6,
    GUARD_DOMAIN = 7,
    GUARD_LOCAL_IP = 8,
    GUARD_PAYLOAD_CHECKSUM = 9,
};

enum SettingsType: uint16 {
    TYPE_NONE = 0,
    TYPE_SHORT = 1,
    TYPE_INT = 2,
    TYPE_PTR = 3,
};

struct GuardrailSetting {
    GuardOption option;         // uint16
    SettingsType type;          // uint16
    uint16 length;              // uint16
    char value[length];
};