dissect.cobaltstrike documentation

Welcome! This is the official documentation for dissect.cobaltstrike.

dissect.cobaltstrike is a Python library for dissecting and parsing Cobalt Strike related data such as beacon payloads and Malleable C2 Profiles.

Source code can be found here:

• https://github.com/fox-it/dissect.cobaltstrike

Note

dissect.cobaltstrike is released under the MIT license.

Overview

• Installation
  • Installing from source
  • Running tests
  • Linting
  • Documentation
• Examples
  • Beacon Configuration
  • Memory dumps
  • PE Artifacts
  • C2 Profiles
  • BeaconConfig to C2 Profile
  • Stager URIs and checksum8

Tools

• beacon-dump
• beacon-xordecode
• c2profile-dump

Reference

• API reference
  • Submodules
• Structure definitions
  • dissect.cobaltstrike.beacon.CS_DEF
  • dissect.cobaltstrike.pe.PE_DEF
• C2Profile grammar

Indices and tables

• Index

• Module Index

• Search Page