Parses Cobalt Strike malleable C2 profiles with pyMalleableC2 to extract Beacon configs, HTTP GET/POST patterns, User-Agents, sleep/jitter. Detects C2 servers using JARM TLS fingerprints for investigating suspicious infrastructure.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
使用 pyMalleableC2 库解析可延展 C2 配置文件，提取失陷指标（IOC）和检测机会。结合 JARM 指纹识别来识别 C2 服务器。
Parses Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract C2 indicators, evasion techniques, and generate Suricata/Snort network detection signatures. Useful for malware analysis and threat hunting.
Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate network detection signatures.
Parses Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike and pyMalleableC2 to extract indicators, detect evasions, and generate network detection signatures.
Share bugs, ideas, or general feedback.
使用 pyMalleableC2 库解析可延展 C2 配置文件，提取失陷指标（IOC）和检测机会。结合 JARM 指纹识别来识别 C2 服务器。
from malleablec2 import Profile
# 从文件解析可延展配置文件
profile = Profile.from_file("amazon.profile")
# 提取全局选项（休眠时间、抖动、User-Agent）
print(profile.ast.pretty())
# 获取 HTTP-GET 块的 URI 和 Headers，用于构建网络签名
# 获取 HTTP-POST 块中的数据外泄模式
# 对已知 C2 基础设施生成 JARM 指纹
关键分析步骤：
# 解析配置文件并提取检测指标
from malleablec2 import Profile
p = Profile.from_file("cobaltstrike.profile")
print(p) # 重建的源码
# 对可疑 C2 服务器进行 JARM 扫描
import subprocess
result = subprocess.run(
["python3", "jarm.py", "suspect-server.com"],
capture_output=True, text=True
)
print(result.stdout)
# 将指纹与已知 CS JARM 哈希进行比对