pybeacon

PyBeacon PyBeacon은 Cobalt Strike의 암호화된 트래픽을 처리하기 위한 스크립트 모음입니다. 비콘 메타데이터를 암호화/복호화하고, 대칭 암호화된 태스킹을 파싱할 수 있습니다. 포함된 스크립트 암호화/디코딩 메서드를 포함하는 작은 라이브러리가 있지만, 몇 가지 예제 스크립트가 포함되어 있습니다. stager-decode.py - 이 도구는 스테이저 URL에서 비콘 DLL을 간단히 디코딩합니다 공개 키를 추출하는 데 사용할 수 있습니다. register.py - 이 도구는 RSA 암호화된 메타데이터를 처리하며...

MAL-2026-6767 Malicious code in @marketfront/basemarkettemplate (npm)

The @marketfront/basemarkettemplate package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and...

Malicious code in @marketfront/devtoolsloader (npm)

The @marketfront/devtoolsloader package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

suricata-rules

This repository contains Suricata IDS Intrusion Detection System rules for detecting various types of malicious activity, including CobaltStrike, crypto miners, and other threats. The rules are designed to identify specific patterns and behaviors associated with these threats. The rules are...

AzureC2Relay - An Azure Function That Validates And Relays Cobalt Strike Beacon Traffic By Verifying The Incoming Requests Based On A Cobalt Strike Malleable C2 Profile

AzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile. Any incoming requests that do not share the profiles user-agent, URI paths, headers, and query parameters, will be redirected ...