agentsclimarketplace
Sign in

Hunting cobalt strike traffic

Skill meltedinhex/analyst-ai-pack/skills/hunting-cobalt-strike-traffic

Hunts for Cobalt Strike beacon traffic by detecting default stager URI checksum8 values, default Malleable C2 profile artifacts, and default ports/named pipes in HTTP and process telemetry. Activates for requests to hunt Cobalt Strike, detect beacon stager URIs, or find default Malleable C2 indicators.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-cobalt-strike-traffic

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, 436 tokens by cl100k_base, as published. Nobody here has run it

Hunting Cobalt Strike Traffic

When to Use

  • You have HTTP request logs (proxy/Zeek http.log) and/or process telemetry and want to detect default-configuration Cobalt Strike beacons.
  • You are triaging suspected C2 using known default artifacts before deeper analysis.

Do not use default-indicator detection as proof — operators customize Malleable C2 profiles. Absence of defaults does not mean no Cobalt Strike. This skill parses telemetry and executes nothing.

Prerequisites

  • HTTP request URIs and/or process/pipe telemetry.

Workflow

Step 1: Detect default stager URIs

python scripts/analyst.py hunt http.csv

Flags request URIs whose path matches the Cobalt Strike default stager checksum8 algorithm (sum of the path characters mod 256 equals 92 for x86 or 93 for x64 stagers).

Step 2: Match default profile artifacts

Flag default user-agents, default URIs (/__utm.gif, /submit.php, /pixel), and default named pipes (\\.\pipe\msagent_*, \\.\pipe\status_*) when present in telemetry.

Step 3: Confirm

Corroborate with beaconing periodicity and destination reputation; pivot to memory/config analysis.

Step 4: Operationalize

Write detections for checksum8 URIs and known default artifacts, accepting they catch defaults only.

Validation

  • checksum8 detection correctly computes the path-character sum mod 256.
  • Default profile artifacts are matched exactly, not by loose substrings.
  • Findings are presented as default-indicator hits, not definitive attribution.

Pitfalls

  • Customized Malleable C2 profiles defeating all default-artifact checks.
  • checksum8 false positives on unrelated short URIs — corroborate with other signals.
  • Treating a single default hit as confirmation without behavioral corroboration.

References

What ships with it: 3 files

5.1 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.