Record · corpus.blog/posts/01a0872d-344c-72eb-8c71-de221cf99e52

Bulk Analysis of Cobalt Strike's Beacon Configurations

archcloudlabs.com · published 1 July 2022

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at archcloudlabs.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 24
Words captured: 818

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://twitter.com/silascutler

twitter.com

https://twitter.com/silascutler/status/1529519000178368513

twitter.com

https://www.cobaltstrike.com/

cobaltstrike.com

https://attack.mitre.org/software/S0154/

attack.mitre.org

https://blog.morphisec.com/how-to-stop-ransomware-breach-prevention-vs-cobalt-strike-backdoor

blog.morphisec.com

https://www.cobaltstrike.com/cobalt-strike-datasheet/

cobaltstrike.com

https://trial.cobaltstrike.com/help-malleable-c2

trial.cobaltstrike.com

https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/malleable-c2-extend_main.htm

hstechdocs.helpsystems.com

https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics_aggressor-scripts/as-resources_functions.htm?Highlight=spawnto

hstechdocs.helpsystems.com

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview

docs.microsoft.com

https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/malleable-c2-extend_process-injection.htm

hstechdocs.helpsystems.com

https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createthread

docs.microsoft.com

https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createremotethread

docs.microsoft.com

http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FAPC%2FNtQueueApcThread.html

undocumented.ntinternals.net

https://www.archcloudlabs.com/

archcloudlabs.com

http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FExecutable%20Images%2FRtlCreateUserThread.html

undocumented.ntinternals.net

https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-setthreadcontext

docs.microsoft.com

https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualallocex

docs.microsoft.com

http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtMapViewOfSection.html

undocumented.ntinternals.net

https://www.ired.team/offensive-security/defense-evasion/finding-all-rwx-protected-memory-regions

ired.team

https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/malleable-c2_profile-language.htm?Highlight=sleeptime

hstechdocs.helpsystems.com

https://www.malshare.com

malshare.com

https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/welcome_main.htm

hstechdocs.helpsystems.com

https://www.mandiant.com/resources/defining-cobalt-strike-components

mandiant.com