mcpField
C
c2-beacon-analysis

c2-beacon-analysis

github.com/wgpsecSecurity1.8k43 installsUpdated 4d ago
Repository

About c2-beacon-analysis

A C2 Beacon configuration extraction and analysis methodology for red teams and defenders. It covers sample identification, configuration parsing, memory scanning, and traffic indicators, with detection signature examples and OPSEC considerations.

Key features

  1. 01Identify samples from multiple C2 frameworks
  2. 02Extract Cobalt Strike configurations
  3. 03Scan memory for Beacons
  4. 04Analyze Beacon traffic indicators
  5. 05Suricata detection signature examples
  6. 06Review configuration exposure and OPSEC

Use cases

  1. 01Analyze captured Beacon files or memory dumps
  2. 02Derive C2 indicators from network traffic
  3. 03Inform Suricata rule development
  4. 04Review identifiable traits in C2 configurations

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/wgpsec/aboutsecurity --skill c2-beacon-analysis

After installing, type/c2-beacon-analysisin Claude Code to confirm it loaded.

Bundled filesreferences/cs-beacon-decrypt.mdreferences/modern-c2-analysis.md

Details

From the project README

C2 Beacon 配置提取与分析

红队价值：了解 Beacon 泄露哪些配置信息 → 定制 Malleable Profile → 加强 C2 OPSEC

⛔ 深入参考

Phase 1: Beacon 类型识别

捕获的样本类型？
├─ PE/DLL 文件 → Phase 2（配置提取）
├─ Shellcode → Phase 2（需先识别 stage）
├─ 内存 dump → Phase 3（内存扫描）
├─ PCAP 流量 → Phase 4（流量解码）
└─ 进程 dump（MiniDump）→ Phase 3

快速识别 C2 框架：

# YARA 扫描识别框架
yara -r c2_rules.yar sample.bin

# 字符串特征
strings sample.bin | grep -iE "(beacon|sleeptime|jitter|watermark|pipe)"   # CS
strings sample.bin | grep -iE "(sliver|implant|mtls|wg)"                   # Sliver
strings sample.bin | grep -iE "(havoc|demon|teamserver)"                   # Havoc

Phase 2: Cobalt Strike Beacon 配置提取

自动提取（首选）
from dissect.cobaltstrike.beacon import BeaconConfig
import json

configs = list(BeaconConfig.from_path("beacon.bin"))
for cfg in configs:
    settings = cfg.as_dict()
    # 关键字段
    print(f"C2 Server:   {settings.get('SETTING_DOMAINS')}")
    print(f"Port:        {settings.get('SETTING_PORT')}")
    print(f"Sleep:       {settings.get('SETTING_SLEEPTIME')}ms")
    print(f"Jitter:      {settings.get('SETTING_JITTER')}%")
    print(f"User-Agent:  {settings.get('SETTING_USERAGENT')}")
    print(f"Watermark:   {settings.get('SETTING_WATERMARK')}")
    print(f"SpawnTo x64: {settings.get('SETTING_SPAWNTO_X64')}")
    print(f"PipeName:    {settings.get('SETTING_PIPENAME')}")
    print(f"BeaconType:  {settings.get('SETTING_BEACONTYPE')}")  # 0=HTTP,1=HTTPS,8=DNS
手动解密（自动工具失败时）
import struct

def decrypt_cs_config(data):
    """手动 XOR 解密 CS Beacon 配置"""
    # CS4: XOR key 0x2e, CS3: XOR key 0x69
    for xor_key in [0x2e, 0x69]:
        # 搜索加密后的 magic: 0x0001 0x0002 (BeaconType, Short)
        magic = bytes([0x00 ^ xor_key, 0x01 ^ xor_key,
                       0x00 ^ xor_key, 0x02 ^ xor_key])
        offset = data.find(magic)
        if offset != -1:
            config_blob = bytes([b ^ xor_key for b in data[offset:offset+4096]])
            return parse_tlv(config_blob)
    return None

def parse_tlv(data):
    """解析 TLV 格式配置"""
    FIELDS = {1:"BeaconType", 2:"Port", 3:"SleepTime", 5:"Jitter",
              8:"C2Server", 9:"UserAgent", 10:"PostURI", 26:"Watermark",
              36:"PipeName", 54:"SpawnTo_x64", 55:"SpawnTo_x86"}
    results = {}
    pos = 0
    while pos + 6 <= len(data):
        ftype = struct.unpack(">H", data[pos:pos+2])[0]
        dtype = struct.unpack(">H", data[pos+2:pos+4])[0]
        flen = struct.unpack(">H", data[pos+4:pos+6])[0]
        if ftype == 0: break
        val = data[pos+6:pos+6+flen]
        name = FIELDS.get(ftype, f"0x{ftype:04x}")
        if dtype == 3:  # string
            results[name] = val.rstrip(b'\x00').decode(errors='replace')
        elif dtype == 2:  # int
            results[name] = struct.unpack(">I", val[:4])[0]
        elif dtype == 1:  # short
            results[name] = struct.unpack(">H", val[:2])[0]
        pos += 6 + flen
    return results

Phase 3: 内存扫描提取

# Volatility3 扫描进程内存
vol3 -f memory.dmp windows.memmap --pid <PID> --dump
# 对 dump 出的文件用 Phase 2 方法提取

# 1768.py (JPCERT) — 专门的 CS config 扫描
python3 1768.py -f memory.dmp

# CobaltStrikeParser 扫描内存
python3 parse_beacon_config.py memory.dmp

Phase 4: 网络流量分析

从 Beacon 配置推导网络签名：
├─ HTTP(S) Beacon → URI 路径 + UA + Host Header + 心跳间隔
├─ DNS Beacon → DNS 查询模式 + 子域名编码方式
├─ SMB Beacon → Named Pipe 名称
└─ TCP Beacon → 端口 + 协议特征

生成检测签名示例：

# Suricata
alert http any any -> any any (msg:"CS Beacon URI";
  content:"/api/v1/check"; http_uri;
  content:"Mozilla/5.0"; http_user_agent;
  threshold:type both, track by_src, count 5, seconds 300;
  sid:1000001; rev:1;)

Phase 5: 红队 OPSEC 反思

分析结果 → 你的 C2 应该避免以下暴露：

暴露点对策
默认 Watermark用合法 license 或 patch 掉
固定 User-AgentMalleable Profile 随机化
固定 URI 路径模仿真实业务 API
默认 Named Pipe \\.\pipe\msagent_*自定义管道名
默认 SpawnTo rundll32.exe改为 svchost.exe 或其他合法进程
固定 Sleep+Jitter增加 Jitter 到 30%+
XOR key 已知(0x2e/0x69)使用 Sleep Mask + 堆加密

工具速查

工具用途
dissect.cobaltstrikePython CS 配置解析
CobaltStrikeParser (S1)CS Beacon 配置提取
1768.py (JPCERT)CS 扫描器
BeaconEye内存实时扫描 CS Beacon
Volatility3内存取证
YARA签名匹配

Comments

Markdown supported