Hunt-Sleeping-Beacons

Hunt-Sleeping-Beacons This project is mostly a callstack scanner which tries to identify IOCs indicating an unpacked or injected C2 agent. All checks are based on the observation that C2 agents wait between their callbacks causing the beacons thread to idle and this tool aims to analyze what...

cobaltstrike-sleepmask-yara

cobaltstrike-sleepmask-yara Solo un repositorio git para la regla de detección de sleepmask que encontré en https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs tl;dr En resumen, estos bytes forman parte del sleep mask kit sección .text sin ofusc...