13 open-source projects similar to cedowens/c2-jarm, ranked by shared indexed features. Tags may describe platforms or build tools rather than the same primary purpose. Check each project’s use case, license, and deployment requirements before treating it as a replacement.
Behavior based monitoring and hunting tool built in C# leveraging ETW tracing. Blue teamers can use this tool to detect and respond to potential Cobalt Strike beacons. Red teamers can use this tool to research ETW bypasses and discover new processes that behave like beacons.
Scan files or process memory for CobaltStrike beacons and parse their configuration
BeaconEye scans running processes for active CobaltStrike beacons. When processes are found to be running beacon, BeaconEye will monitor each process for C2 activity.
https://research.nccgroup.com/2022/03/25/mining-data-from-cobalt-strike-beacons/
Tool based on CobaltStrikeParser from SentinelOne which can be used to spam a CobaltStrike server with fake beacons
Toolset for research malware and Cobalt Strike beacons
Please read the initial JARM blog post for more information.
Python parser for CobaltStrike Beacon's configuration
The Pointer was developed for hunting and mapping Cobalt Strike servers exposed to the Internet. The tool includes the complete methodology for identifying Cobalt Strike servers. It is intended to speed up the process of detecting Cobalt Strike servers among a large number of potential targets…
This project is ( mostly ) a callstack scanner which tries to identify IOCs indicating an unpacked or injected C2 agent.