threatexpress/malleable-c2

Cobalt Strike Malleable C2 Design and Reference Guide

Cobalt Strike Malleable C2 Design and Reference Guide

This project is intended to serve as reference when designing Cobalt Strike Malleable C2 profiles.

Always verify your profile with ./c2lint [/path/to/my.profile] prior to use!

Malleable C2 Profile Guidance

The following dive deeper into the understanding of Malleable C2

• MalleableExplained.md : Quick profile reference guide
• ThreatExpress - A Deep Dive into Cobalt Strike Malleable C2 : Orignal blog post the where the jquery reference profile was created
• Understanding Cobalt Strike Profiles : Revised (current) blog on profile guidance
• Random Profile Generator : Profile generator with more examples and options for settings

Changelog

20231017 - Updated for CS 4.9

• Added 4.9 reference profile
• Updated MalleableExplained.md with new 4.9 options
  • post-ex.cleanup
  • .http-beacon.library

20230801 - Updated for CS 4.8

• Added 4.8 reference profile
• Updated MalleableExplained.md with new 4.8 options
  • stage.syscall_method

20221022 - Updated for CS 4.7

• Added 4.7 reference profile
• Updated MalleableExplained.md with 4.7 considerations

20220421 - Updated for CS 4.6

• Added 4.6 reference profile
• No more '1MB' limit
  • Add section "Task and Proxy Max Size" with new options
    • set tasks_max_size "1048576";
    • set tasks_proxy_max_size "921600";
    • set tasks_dns_proxy_max_size "71680";
  • Additional Considerations for the 'task_' Settings
• Updated MalleableExplained.md with 4.6 considerations

202112 - Updated for CS 4.5

• Added 4.5 reference profile
• Updated MalleableExplained.md with 4.5 considerations

202108 - Added MalleableExplained.md

• Reference from Andy Gill (@ZephrFish)
• Reference blog: https://blog.zsec.uk/cobalt-strike-profiles/

202103 - Add CS 4.3 Reference Profile

• Add latest Malleable C2 profile options for Cobalt Strike 4.3
• Moved dns settings to new dns-beacon section
• 4.3 Additions
  • dns-beacon
    • beacon
    • get_A
    • get_AAAA
    • get_TXT
    • put_metadata
    • put_output
    • ns_response
  • http-config
    • block_useragents

202011 - Add CS 4.2 Reference Profile

• Add latest MalleablePE and MalleableC2 options for Cobalt Strike 4.1 and 4.2
• 4.1 Additions: tcp_frame_header, smb_frame_header, ssh_banner
• 4.2 Additions:
  • global
    • data_jitter
    • headers_remove
    • ssh_pipename
  • postex
    • pipename
    • thread_hint
    • keylogger
  • stage
    • allocator
    • magic_mz_86|magic_mz_64
    • magic_pe

202003 - CS 4.0 Reference Profile

• Add CS4.0 reference profile of available malleable C2 options
• Remove deprecated features (amsi_disable, disable for process injection techniques, etc)

Authors

• @joevest
• @001SPARTaN
• @andrewchiles
• @Charles-Foster-Kane

License

This project and all individual scripts are under the GNU GPL v3.0 license.