Cobalt Strike Beacon Extractor
ID: 725de999-adb9-5d16-ad19-ee64b325d8b0
STIX ID: report--725de999-adb9-5d16-ad19-ee64b325d8b0
Feed Name: Elastic Security Labs
This document describes a Python-based tool that queries Elastic Endpoint alerts for Cobalt Strike detections, extracts beacon configuration data from captured memory, and outputs normalized ECS-formatted JSON to Elasticsearch or the console. It provides Docker and Poetry setup steps, example configuration, time-based filtering options, and methods to pipe results to other tools for analysis.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.