CobaltStrikeScan v1.1 releases: Scan files or process memory for Cobalt Strike beacons
Scan files or process memory for Cobalt Strike beacons and parse their configuration.
CobaltStrikeScan scans Windows process memory for evidence of DLL injection (classic or reflective injection) and performs a YARA scan on the target process’ memory for Cobalt Strike v3 and v4 beacon signatures.
Alternatively, it can perform the same YARA scan on a file supplied by an absolute or relative path as a command-line argument.
If a Cobalt Strike beacon is detected in the file or process, the beacon’s configuration will be parsed and displayed to the console.
- Users can choose to scan ALL (x64) running processes for Cobalt Strike beacons instead of just injected threads
- ‘-d’ option allows scanning of all dump files in a directory for Cobalt Strike beacons
- Added support for scanning of large dump files (> 2GB) e.g. RAM captures. (won’t output process information)
- Added ability to detect and parse non-encoded configuration sections (usually found when trial versions of Cobalt Strike are used)
- Scanning a dump file would only parse and output the first beacon detection.
- Stopped outputting multiple instances of the same beacon from a single process/file
- 64-bit Windows OS
- .NET Framework 4.6
- Administrator or SeDebugPrivilege is required to scan process memory for injected threads
Cloning this repo
CobaltStrikeScan contains GetInjectedThreads as a submodule.
git clone --recursive https://github.com/Apr4h/CobaltStrikeScan.git