Cobalt Strike Malleable C2 Design and Reference Guide

This project is intended to serve as reference when designing Cobalt Strike Malleable C2 profiles.

Always verify your profile with ./c2lint [/path/to/my.profile] prior to use!

Changelog

202003 - CS 4.0 Reference Profile

Add CS4.0 reference profile of available malleable C2 options
Remove deprecated features (amsi_disable, disable for process injection techniques, etc)

Authors

@joevest
@001SPARTaN
@andrewchiles

License

This project and all individual scripts are under the GNU GPL v3.0 license.

Links

ThreatExpress - A Deep Dive into Cobalt Strike Malleable C2