How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
Scan files or process memory for CobaltStrike beacons and parse their configuration
BeaconEye scans running processes for active CobaltStrike beacons. When processes are found to be running beacon, BeaconEye will monitor each process for C2 activity.
https://research.nccgroup.com/2022/03/25/mining-data-from-cobalt-strike-beacons/
Behavior based monitoring and hunting tool built in C# leveraging ETW tracing. Blue teamers can use this tool to detect and respond to potential Cobalt Strike beacons. Red teamers can use this tool to research ETW bypasses and discover new processes that behave like beacons.
A list of JARM hashes for different ssl implementations used by some C2 tools. Also adding other useful red team tools that use ssl (ex: EvilGinx2). Though I work on the red team side, I thought this would be a good thing to gather both to help blue teams who have the appropriate visibility with…
The main features of cedowens/c2-jarm are: Detection Tools.
Open-source alternatives to cedowens/c2-jarm include: apr4h/cobaltstrikescan — Scan files or process memory for CobaltStrike beacons and parse their configuration. ccob/beaconeye — BeaconEye scans running processes for active CobaltStrike beacons. When processes are found to be running beacon,… fox-it/cobaltstrike-beacon-data — https://research.nccgroup.com/2022/03/25/mining-data-from-cobalt-strike-beacons/. hariomenkel/cobaltspam — Tool based on CobaltStrikeParser from SentinelOne which can be used to spam a CobaltStrike server with fake beacons. jpcertcc/aa-tools — Artifact analysis tools by JPCERT/CC Analysis Center. 3lp4tr0n/beaconhunter — Behavior based monitoring and hunting tool built in C# leveraging ETW tracing. Blue teamers can use this tool to…