From cybersecurity-skills
Parses Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate network detection signatures.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersecurity-skills:analyzing-cobaltstrike-malleable-c2-profilesThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Cobalt Strike Malleable C2 profiles are domain-specific language scripts that customize how Beacon communicates with the team server, defining HTTP request/response transformations, sleep intervals, jitter values, user agents, URI paths, and process injection behavior. Threat actors use malleable profiles to disguise C2 traffic as legitimate services (Amazon, Google, Slack). Analyzing these pro...
Cobalt Strike Malleable C2 profiles are domain-specific language scripts that customize how Beacon communicates with the team server, defining HTTP request/response transformations, sleep intervals, jitter values, user agents, URI paths, and process injection behavior. Threat actors use malleable profiles to disguise C2 traffic as legitimate services (Amazon, Google, Slack). Analyzing these profiles reveals network indicators for detection: URI patterns, HTTP headers, POST/GET transforms, DNS settings, and process injection techniques. The dissect.cobaltstrike library can parse both profile files and extract configurations from beacon payloads, while pyMalleableC2 provides AST-based parsing using Lark grammar for programmatic profile manipulation and validation.
dissect.cobaltstrike and/or pyMalleableC2pip install dissect.cobaltstrike or pip install pyMalleableC2C2Profile.from_path("profile.profile")A JSON report containing extracted C2 URIs, HTTP headers, user agents, sleep/jitter settings, process injection config, spawned process paths, DNS settings, and generated Suricata-compatible detection rules.
npx claudepluginhub mukul975/anthropic-cybersecurity-skills --plugin cybersecurity-skillsParses Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate network detection signatures.
Parses and analyzes Cobalt Strike Malleable C2 profiles to extract C2 indicators, detect evasion techniques, and generate network detection signatures.
Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate network detection signatures.