Skip to content
Get packs

Cobalt Strike Beacon Config Analyzer

Pulls C2 server, profile and watermark details out of Cobalt Strike beacon samples for incident response

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

This skill gives the agent a structured procedure for examining suspected Cobalt Strike beacon files (Windows executables, shellcode, or memory dumps) and extracting their embedded configuration. Cobalt Strike is a commercial penetration-testing tool that attackers often misuse, and its beacons store settings such as command-and-control server addresses, sleep and jitter timings, disguise profiles, and watermark IDs. With the skill, the agent can report those indicators in a readable form to help a responder map attacker infrastructure and link related samples.

Great for

  • Incident responders and SOC analysts triaging a suspected Cobalt Strike infection
  • Malware analysts building threat intelligence on C2 infrastructure
  • Students learning how beacon configuration is structured and encoded

Skip it if

  • Attacking or operating live systems: this is a defensive analysis procedure, and the scripts only parse files you already have. Using extracted configs to target third parties could be illegal.
  • Samples you are not authorised to handle: running or parsing live malware carries risk and should be done in an isolated analysis environment.
  • Non-Cobalt Strike malware: the TLV field tables and XOR keys are specific to Cobalt Strike beacons and will not help with other families.

Try asking

  • “Extract the C2 server, sleep time and jitter from this beacon.exe sample and summarise them.”
  • “Scan this memory dump for embedded Cobalt Strike configurations and list the watermark values.”
  • “Batch-process the samples folder and produce a JSON report of C2 domains and named pipes.”
  • “Explain what the malleable C2 profile fields in this beacon config suggest about the operator's disguise tradecraft.”
Step-by-step guide: how to use Cobalt Strike Beacon Config AnalyzerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    analyzing-cobalt-strike-beacon-configuration.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-cobalt-strike-beacon-configuration.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-cobalt-strike-beacon-configuration.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the scripts on an isolated analysis machine, since they process potentially malicious binaries.
  • Check the script output against a second parser, because the embedded XOR-decoding examples are partial and the field ID tables differ between the two scripts.
  • Pair extracted C2 indicators with threat intelligence and network logs rather than treating them as conclusions on their own.

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.