SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
hunting-cobalt-strike-traffic
0
Hunts for Cobalt Strike beacon traffic by detecting default stager URI checksum8 values, default Malleable C2 profile artifacts, and default ports/named pipes in HTTP and process telemetry. Activates for requests to hunt Cobalt Strike, detect beacon stager URIs, or find default Malleable C2 indicators.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Hunting Cobalt Strike Traffic ## When to Use - You have HTTP request logs (proxy/Zeek http.log) and/or process telemetry and want to detect default-configuration Cobalt Strike beacons. - You are triaging suspected C2 using known default artifacts before deeper analysis. **Do not use** default-indicator detection as proof — operators customize Malleable C2 profiles. Absence of defaults does not mean no Cobalt Strike. This skill parses telemetry and executes nothing. ## Prerequisites - HTTP request URIs and/or process/pipe telemetry. ## Workflow ### Step 1: Detect default stager URIs ```bash python scripts/analyst.py hunt http.csv ``` Flags request URIs whose path matches the Cobalt Strike default stager checksum8 algorithm (sum of the path characters mod 256 equals 92 for x86 or 93 for x64 stagers). ### Step 2: Match default profile artifacts Flag default user-agents, default URIs (`/__utm.gif`, `/submit.php`, `/pixel`), and default named pipes (`\\.\pipe\msagent_*`, `\\.\pipe\status_*`) when present in telemetry. ### Step 3: Confirm Corroborate with beaconing periodicity and destination reputation; pivot to memory/config analysis. ### Step 4: Operationalize Write detections for checksum8 URIs and known default artifacts, accepting they catch defaults only. ## Validation - checksum8 detection correctly computes the path-character sum mod 256. - Default profile artifacts are matched exactly, not by loose substrings. - Findings are presented as default-indicator hits, not definitive attribution. ## Pitfalls - Customized Malleable C2 profiles defeating all default-artifact checks. - checksum8 false positives on unrelated short URIs — corroborate with other signals. - Treating a single default hit as confirmation without behavioral corroboration. ## References - See [`references/api-reference.md`](references/api-reference.md) for the hunter. - ATT&CK S0154 Cobalt Strike (linked in frontmatter).