How to use the Cobalt Strike Beacon Config Analyzer agent skill

What this skill makes the agent do

Cobalt Strike is a commercial penetration-testing tool that attackers often misuse. Beacon payloads store embedded settings such as command-and-control (C2) server addresses, sleep and jitter timings, disguise profiles and watermark IDs. This skill directs the agent to extract those settings from suspected Windows executables (PE files), shellcode or memory dumps and report them in a readable form.

The purpose is defensive: the output helps a responder map attacker infrastructure and link related samples. The skill's procedure covers C2 indicators such as domains, user agent, named pipes, spawn-to processes and watermark.

• Extracts beacon configuration from PE files, shellcode or memory dumps
• Reports C2 servers, port, sleep time, jitter, user agent and watermark
• Describes malleable C2 profile settings such as URI paths and metadata encoding
• Helps link multiple beacons to the same operator through watermark values

How to install the skill

Download the skill ZIP from this page. Then add it to your agent using one of the two options below.

Option 1 is a personal install: unzip the download into your user skills folder so the skill sits at ~/.claude/skills/analyzing-cobalt-strike-beacon-configuration/. Option 2 is a project install: place the same folder inside your project's .claude/skills/ directory so it applies only to that project.

Option 3 is to upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

Install the Python dependencies

The skill's scripts need Python 3.9 or newer. The core library is dissect.cobaltstrike, which you can install with pip. The skill also relies on pefile and yara-python.

Optional tools help with specific tasks: SentinelOne's CobaltStrikeParser, Volatility3 or WinDbg for memory work, Wireshark for traffic correlation, and a hex editor such as HxD for manual inspection.

• Required: Python 3.9+, dissect.cobaltstrike, pefile, yara-python
• Optional: CobaltStrikeParser, Volatility3 or WinDbg, Wireshark, HxD

How to trigger the skill with natural requests

You do not need to name the skill or its scripts. Describe the task and attach or point to the file. The agent should pick up the skill when your request involves extracting or analysing Cobalt Strike beacon configuration.

Give the agent the context it needs: the file or dump location, what you are investigating, and what output you want, such as a table of indicators you can paste into a report.

• Extract the beacon config from this file and list the C2 domains, sleep time and jitter.
• This memory dump may contain Cobalt Strike. Pull out the watermark and named pipe so I can check for related samples.
• Fill in our beacon analysis report template using the config from this sample.
• Explain how the malleable C2 profile in this beacon disguises its HTTP traffic.

What the output looks like

The extraction script prints each configuration it finds and labels the critical fields for incident response, including C2 request and recover settings, domains, beacon type, port, sleep time, jitter, spawn-to paths, pipe name, watermark, verbs, user agent and protocol. It then groups C2 indicators into domains, IPs, URLs, user agent, named pipes, spawn processes and watermark.

The skill also includes a report template with sections for metadata, a configuration summary, C2 infrastructure and malleable C2 profile details, which the agent can fill in for you.

• Configuration summary table: beacon type, C2 servers, port, sleep, jitter, user agent, watermark, spawn-to, pipe, host header, crypto scheme
• C2 infrastructure table: domains, IPs and URI paths with context
• Malleable C2 profile tables for HTTP GET and POST

Safety notes before you run it

This skill runs scripts. Its scripts parse files you already have and are meant for defensive analysis. Do not use the extracted configuration to target third parties, and be aware that using it that way could be illegal.

Parsing live malware carries risk. Only handle samples you are authorised to analyse, and do so in an isolated analysis environment. The skill's documentation notes that network use is not required, so keep analysis machines offline where practical.

The TLV field tables and XOR keys are specific to Cobalt Strike beacons. The skill will not help with other malware families.

• Runs scripts: yes. Uses network: no.
• Use an isolated analysis environment for suspected malware.
• Only analyse samples you are authorised to handle.
• Not for attacking or operating live systems.