npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
Cobalt Strike Malleable C2 profiles are domain-specific language scripts that customize how Beacon communicates with the team server, defining HTTP request/response transformations, sleep intervals, jitter values, user agents, URI paths, and process injection behavior. Threat actors use malleable profiles to disguise C2 traffic as legitimate services (Amazon, Google, Slack). Analyzing these pro...
Parses Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike and pyMalleableC2 to extract indicators, detect evasions, and generate network detection signatures.
Parses Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract C2 indicators, evasion techniques, and generate Suricata/Snort network detection signatures. Useful for malware analysis and threat hunting.
Extracts and analyzes Cobalt Strike beacon configurations from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft. For malware analysis and threat hunting.
Share bugs, ideas, or general feedback.
Cobalt Strike Malleable C2 profiles are domain-specific language scripts that customize how Beacon communicates with the team server, defining HTTP request/response transformations, sleep intervals, jitter values, user agents, URI paths, and process injection behavior. Threat actors use malleable profiles to disguise C2 traffic as legitimate services (Amazon, Google, Slack). Analyzing these profiles reveals network indicators for detection: URI patterns, HTTP headers, POST/GET transforms, DNS settings, and process injection techniques. The dissect.cobaltstrike library can parse both profile files and extract configurations from beacon payloads, while pyMalleableC2 provides AST-based parsing using Lark grammar for programmatic profile manipulation and validation.
dissect.cobaltstrike and/or pyMalleableC2pip install dissect.cobaltstrike or pip install pyMalleableC2C2Profile.from_path("profile.profile")A JSON report containing extracted C2 URIs, HTTP headers, user agents, sleep/jitter settings, process injection config, spawned process paths, DNS settings, and generated Suricata-compatible detection rules.