<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cobalt Strike Beacon Analysis — API Reference

## dissect.cobaltstrike

### Installation

```bash
pip install dissect.cobaltstrike
```

### Key Classes

#### `BeaconConfig.from_path(path)`
Parse beacon config from file path. Returns list of `BeaconConfig` objects.

```python
from dissect.cobaltstrike.beacon import BeaconConfig
configs = list(BeaconConfig.from_path("beacon.bin"))
config = configs[0]
settings = config.as_dict()
```

#### `BeaconConfig.from_bytes(data)`
Parse from raw bytes (memory dumps, carved payloads).

### Configuration Fields

| Setting | Type | Description |
|---------|------|-------------|
| `SETTING_BEACONTYPE` | int | 0=HTTP, 1=DNS, 2=SMB, 4=TCP, 8=HTTPS |
| `SETTING_PORT` | int | C2 listener port |
| `SETTING_SLEEPTIME` | int | Beacon interval in milliseconds |
| `SETTING_JITTER` | int | Jitter percentage (0-99) |
| `SETTING_DOMAINS` | str | Comma-separated C2 domains |
| `SETTING_USERAGENT` | str | HTTP User-Agent string |
| `SETTING_SPAWNTO_X86` | str | x86 spawn-to process path |
| `SETTING_SPAWNTO_X64` | str | x64 spawn-to process path |
| `SETTING_PIPENAME` | str | Named pipe for SMB beacon |
| `SETTING_WATERMARK` | int | License watermark (4-byte int) |
| `SETTING_PUBKEY` | bytes | RSA public key for encryption |

## SentinelOne CobaltStrikeParser

### Installation

```bash
git clone https://github.com/Sentinel-One/CobaltStrikeParser
pip install -r requirements.txt
```

### Usage

```bash
python parse_beacon_config.py beacon.bin
python parse_beacon_config.py --json beacon.bin
python parse_beacon_config.py --dump-raw beacon.bin
```

## YARA Rules for Detection

### Common Detection Patterns

```yara
rule CobaltStrike_Beacon_Encoded {
    strings:
        $config_v4 = { 2e 2f 2e 2c }  // XOR 0x2e marker
        $config_v3 = { 69 68 69 6b }  // XOR 0x69 marker
    condition:
        uint16(0) == 0x5A4D and any of them
}
```

## Volatility3 Memory Extraction

```bash
# Dump process memory containing beacon
vol3 -f memory.dmp windows.memmap --pid 1234 --dump

# Scan for beacon in memory
vol3 -f memory.dmp windows.vadyarascan --yara-file cs_beacon.yar
```

## Common XOR Keys

| Version | Config XOR Key | Beacon XOR Key |
|---------|---------------|----------------|
| CS 3.x | `0x69` | 4-byte key (varies) |
| CS 4.x | `0x2e` | 4-byte key (varies) |
| CS 4.5+ | `0x2e` | Additional obfuscation layers |
