Scan files or process memory for CobaltStrike beacons and parse their configuration
Las características principales de apr4h/cobaltstrikescan son: Detection Tools, Endpoint Security.
Las alternativas de código abierto para apr4h/cobaltstrikescan incluyen: orange-cyberdefense/goad — GOAD is an Ansible-based automation tool and infrastructure orchestrator used to deploy pre-configured networks of… ccob/beaconeye — BeaconEye scans running processes for active CobaltStrike beacons. When processes are found to be running beacon,… cedowens/c2-jarm — A list of JARM hashes for different ssl implementations used by some C2 tools. Also adding other useful red team tools… essandess/macos-fortress — Firewall and Privatizing Proxy for Trackers, Attackers, Malware, Adware, and Spammers with Anti-Virus On-Demand and… fox-it/cobaltstrike-beacon-data — https://research.nccgroup.com/2022/03/25/mining-data-from-cobalt-strike-beacons/. alichtman/stronghold — Easily configure macOS security settings from the terminal.
GOAD is an Ansible-based automation tool and infrastructure orchestrator used to deploy pre-configured networks of vulnerable Windows virtual machines. It serves as a security training environment for practicing Active Directory penetration testing, privilege escalation, and lateral movement across various cloud platforms and local virtualization hypervisors. The project distinguishes itself through a multi-provider infrastructure model and a system of infrastructure recipes that simulate intentional security misconfigurations. It supports the deployment of varied attack scenarios, including
BeaconEye scans running processes for active CobaltStrike beacons. When processes are found to be running beacon, BeaconEye will monitor each process for C2 activity.
A list of JARM hashes for different ssl implementations used by some C2 tools. Also adding other useful red team tools that use ssl (ex: EvilGinx2). Though I work on the red team side, I thought this would be a good thing to gather both to help blue teams who have the appropriate visibility with…
Easily configure macOS security settings from the terminal.