2703878a74
Fixed publicKey values in tests
2023-02-06 13:44:53 +02:00
232858b355
Removed stripping of public key
2023-02-06 13:42:14 +02:00
c9ef51d5c7
Handle unicode domains
2022-11-15 12:20:15 +02:00
06abd80608
Merge pull request #20 from kw2583/startbytes
...
Cobalt Strike v4 starting bytes
2022-10-25 12:26:39 -04:00
5d32e2135f
Added test case.
2022-08-17 16:27:28 -04:00
07031eea6b
Added sample that fails with current start bytes.
2022-08-16 22:29:29 -04:00
dd55e64978
Updated v4 start bytes.
2022-08-16 22:22:02 -04:00
1a56d3ee07
Merge pull request #18 from rxwx/master
...
Add Cobalt Strike 4.5+ settings
2022-01-04 14:00:21 +02:00
9106720de1
add test for beacon 4.5 features
2022-01-04 11:25:33 +00:00
2ad6f44fc5
Parse Max Retry Strategy settings on CS 4.5
...
Adds parsing of the Max Retry Settings, which was introduced in Cobalt Strike 4.5. This setting dictates what the beacon should do after a specified number of failed connection attempts.
2021-12-15 12:28:34 +00:00
61ce489492
Unpack Watermark Hash Setting on CS 4.5+
...
Cobalt Strike 4.5 adds a watermark hash. This commit adds parsing of this value.
2021-12-15 12:03:28 +00:00
fe36b15651
Merge pull request #17 from drakearonhalt/package
...
Create setup.py to enable module installation via pip.
2021-12-09 11:54:50 +02:00
c6089adb25
Create setup.py to enable module installation via pip.
2021-12-03 07:35:59 -05:00
11721a49f0
Merge branch 'master' of https://github.com/Sentinel-One/CobaltStrikeParser
2021-11-23 11:11:43 +02:00
28f9d7cf87
Print appropriate message when no file or url is found
2021-11-23 11:11:36 +02:00
e518a97f2a
Merge pull request #14 from rxwx/master
...
Update access type enum
2021-11-05 18:06:53 +02:00
55e2cf9898
Update parse_beacon_config.py
...
Add manual proxy setting (no credentials) to the ACCESS_TYPE enum
2021-11-05 10:51:39 +00:00
3ea26aa479
Add Licence
2021-08-08 14:03:17 +03:00
b5e7f4a659
Merge branch 'master' of https://github.com/Sentinel-One/CobaltStrikeParser
2021-05-09 12:55:37 +03:00
a9d8631d1b
updated requirements
2021-05-09 12:55:09 +03:00
bb4dcaf216
Merge pull request #10 from nbareil/master
...
Enables parse_beacon_config.py to process encrypted BEACONS that are not PE and added unittests
2021-05-09 12:47:43 +03:00
061b5ce04d
Add unittest Github action
2021-05-09 12:42:06 +03:00
5bf395bfb3
Apply black
2021-05-07 08:41:20 -07:00
87a6d4a408
Adds unit-test for trial beacons
2021-05-07 08:24:37 -07:00
aa6e4f5b56
Adds unit-test for encrypted x86
2021-05-07 01:42:48 -07:00
845f8269d5
Adds unit-test for encrypted beacon x86_64
2021-05-07 01:37:49 -07:00
fbf1e8f30d
Merging decrypt_beacons()
2021-05-07 01:29:27 -07:00
535194359a
Adds unit-tests
2021-05-07 00:58:21 -07:00
5611270154
If none of the signatures match, abort!
2021-05-06 00:45:18 -07:00
2b07f53d88
Enables parse_beacon_config.py to process BEACONS that are not PE
...
Example: 13e954be0b0c022c392c956e9a800201a75dab7e288230b835bcdd4a9d68253d
This code is a rip of https://github.com/Te-k/cobaltstrike/blob/master/lib.py
All credits go to @Te-k
Co-authored-by: Etienne Maynier <tek@randhome.io >
2021-05-06 00:05:52 -07:00
1e401b89f4
comm and improvements
2021-04-29 18:39:58 +03:00
b987870e56
Merge pull request #7 from sixdub/master
...
PublicKey_Md5 Addition
2021-03-28 20:40:43 +03:00
5a988fb5bd
Leave pubkey plain commented
2021-03-26 08:24:14 -04:00
0af3f32297
Leave pubkey plain commented
2021-03-26 08:23:40 -04:00
b89429adde
Added publickey hash and hashBlob feature
2021-03-26 08:16:23 -04:00
fdae5dbe47
General improvements
...
* Added new settings
* Fixed prints
* Removed unnecessary qiling requirement
* Merged two script files
2021-03-25 18:52:20 +02:00
8172610345
Add requirements.txt file and support for xored payloads
2020-10-25 18:55:12 +02:00
48c728a361
Fixed false positives with the short pattern
...
Expanded pattern scanned and made it more compatible with scripts
2020-09-09 16:51:28 +03:00
efecb5dfff
Merge pull request #2 from usualsuspect/malleablec2
...
Added support for Malleable C2 instructions
https://usualsuspect.re/article/cobalt-strikes-malleable-c2-under-the-hood
2020-09-09 16:40:05 +03:00
76c6453351
Added support for Malleable C2 instructions
2020-09-09 14:26:18 +02:00
7647c29c31
Removed parsing hack
2020-05-19 22:57:09 +03:00
c826099d1d
Fixed config decoding bug
2020-05-19 22:53:08 +03:00
531169100b
Give credit
2020-05-11 19:30:48 +03:00
39dcfd9033
First commit
2020-05-05 19:41:09 +03:00
b1703e7906
Initial commit
2020-05-05 11:04:45 +03:00
Kristal-g