SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsc2-beacon-analysis

c2-beacon-analysis

General & other

View repository

Updated 10-16 07:23

About this skill

C2 Beacon Configuration Extraction and Analysis

Red Team Value: Understand which configuration information a Beacon leaks → customize the Malleable Profile → strengthen C2 OPSEC

⛔ In-Depth Reference

Phase 1: Beacon Type Identification

捕获的样本类型？
├─ PE/DLL 文件 → Phase 2（配置提取）
├─ Shellcode → Phase 2（需先识别 stage）
├─ 内存 dump → Phase 3（内存扫描）
├─ PCAP 流量 → Phase 4（流量解码）
└─ 进程 dump（MiniDump）→ Phase 3

Quickly identify the C2 framework:

# YARA 扫描识别框架
yara -r c2_rules.yar sample.bin

# 字符串特征
strings sample.bin | grep -iE "(beacon|sleeptime|jitter|watermark|pipe)"   # CS
strings sample.bin | grep -iE "(sliver|implant|mtls|wg)"                   # Sliver
strings sample.bin | grep -iE "(havoc|demon|teamserver)"                   # Havoc

Phase 2: Cobalt Strike Beacon Configuration Extraction

Automatic extraction (preferred)

from dissect.cobaltstrike.beacon import BeaconConfig
import json

configs = list(BeaconConfig.from_path("beacon.bin"))
for cfg in configs:
    settings = cfg.as_dict()
    # 关键字段
    print(f"C2 Server:   {settings.get('SETTING_DOMAINS')}")
    print(f"Port:        {settings.get('SETTING_PORT')}")
    print(f"Sleep:       {settings.get('SETTING_SLEEPTIME')}ms")
    print(f"Jitter:      {settings.get('SETTING_JITTER')}%")
    print(f"User-Agent:  {settings.get('SETTING_USERAGENT')}")
    print(f"Watermark:   {settings.get('SETTING_WATERMARK')}")
    print(f"SpawnTo x64: {settings.get('SETTING_SPAWNTO_X64')}")
    print(f"PipeName:    {settings.get('SETTING_PIPENAME')}")
    print(f"BeaconType:  {settings.get('SETTING_BEACONTYPE')}")  # 0=HTTP,1=HTTPS,8=DNS

Manual decryption (when automated tools fail)

import struct

def decrypt_cs_config(data):
    """手动 XOR 解密 CS Beacon 配置"""
    # CS4: XOR key 0x2e, CS3: XOR key 0x69
    for xor_key in [0x2e, 0x69]:
        # 搜索加密后的 magic: 0x0001 0x0002 (BeaconType, Short)
        magic = bytes([0x00 ^ xor_key, 0x01 ^ xor_key,
                       0x00 ^ xor_key, 0x02 ^ xor_key])
        offset = data.find(magic)
        if offset != -1:
            config_blob = bytes([b ^ xor_key for b in data[offset:offset+4096]])
            return parse_tlv(config_blob)
    return None

def parse_tlv(data):
    """解析 TLV 格式配置"""
    FIELDS = {1:"BeaconType", 2:"Port", 3:"SleepTime", 5:"Jitter",
              8:"C2Server", 9:"UserAgent", 10:"PostURI", 26:"Watermark",
              36:"PipeName", 54:"SpawnTo_x64", 55:"SpawnTo_x86"}
    results = {}
    pos = 0
    while pos + 6 <= len(data):
        ftype = struct.unpack(">H", data[pos:pos+2])[0]
        dtype = struct.unpack(">H", data[pos+2:pos+4])[0]
        flen = struct.unpack(">H", data[pos+4:pos+6])[0]
        if ftype == 0: break
        val = data[pos+6:pos+6+flen]
        name = FIELDS.get(ftype, f"0x{ftype:04x}")
        if dtype == 3:  # string
            results[name] = val.rstrip(b'\x00').decode(errors='replace')
        elif dtype == 2:  # int
            results[name] = struct.unpack(">I", val[:4])[0]
        elif dtype == 1:  # short
            results[name] = struct.unpack(">H", val[:2])[0]
        pos += 6 + flen
    return results

Phase 3: Memory Scan Extraction

# Volatility3 扫描进程内存
vol3 -f memory.dmp windows.memmap --pid <PID> --dump
# 对 dump 出的文件用 Phase 2 方法提取

# 1768.py (JPCERT) — 专门的 CS config 扫描
python3 1768.py -f memory.dmp

# CobaltStrikeParser 扫描内存
python3 parse_beacon_config.py memory.dmp

Phase 4: Network Traffic Analysis

从 Beacon 配置推导网络签名：
├─ HTTP(S) Beacon → URI 路径 + UA + Host Header + 心跳间隔
├─ DNS Beacon → DNS 查询模式 + 子域名编码方式
├─ SMB Beacon → Named Pipe 名称
└─ TCP Beacon → 端口 + 协议特征

Example of generating a detection signature:

# Suricata
alert http any any -> any any (msg:"CS Beacon URI";
  content:"/api/v1/check"; http_uri;
  content:"Mozilla/5.0"; http_user_agent;
  threshold:type both, track by_src, count 5, seconds 300;
  sid:1000001; rev:1;)

Phase 5: Red Team OPSEC Reflection

Analysis results → Your C2 should avoid the following exposures:

Exposure Point Countermeasure
Default Watermark Use a legitimate license or patch it out
Fixed User-Agent Malleable Profile randomization
Fixed URI path Imitate a real business API
Default Named Pipe \\.\pipe\msagent_* Custom pipe name
Default SpawnTo rundll32.exe Change to svchost.exe or another legitimate process
Fixed Sleep+Jitter Increase Jitter to 30%+
XOR key known (0x2e/0x69) Use Sleep Mask + heap encryption

Tool Quick Reference

Tool Purpose
dissect.cobaltstrike Python CS configuration parsing
CobaltStrikeParser (S1) CS Beacon configuration extraction
1768.py (JPCERT) CS scanner
BeaconEye Real-time memory scanning for CS Beacon
Volatility3 Memory forensics
YARA Signature matching