{"adoption": {"forks": 193, "observed_at": "2026-08-28T04:04:17.614485+00:00", "stars": 1301}, "canonical_url": "https://ross.abutalabs.com/products/awesome-cobaltstrike-defence", "card": {"archived": false, "artifact_type": "learning-resource", "description": "Defences against Cobalt Strike", "domain": ["security", "penetration-testing", "awesome-lists", "developer-tools"], "enriched": true, "function": ["security", "vulnerability-scanning", "monitoring", "developer-tools"], "health_score": 20, "homepage": null, "language": null, "license": "MIT", "license_family": "permissive", "maturity": "maintenance", "member_repos": ["MichaelKoczwara/Awesome-CobaltStrike-Defence"], "name": "MichaelKoczwara/Awesome-CobaltStrike-Defence", "platform": ["cross-platform"], "pushed_at": "2022-07-14T07:15:10+00:00", "repo": "MichaelKoczwara/Awesome-CobaltStrike-Defence", "stars": 1301, "tags": ["awesome-list", "cobalt-strike", "threat-detection", "incident-response", "dfir", "c2-detection", "yara-rules", "threat-hunting"], "topics": ["cobalt-strike", "cobaltstrike-defence", "beacon", "detection", "defences"], "urls": [], "use_cases": ["find tools to detect cobalt strike beacons on my network", "learn how to defend against cobalt strike attacks", "hunt for sleeping beacons in memory", "parse cobalt strike beacon configurations", "find yara rules for detecting cobalt strike malware", "build a threat hunting playbook for C2 traffic"], "what_it_is": "A curated awesome-list of defensive resources, tools, and detection techniques for countering Cobalt Strike, a commercial adversary simulation and post-exploitation framework. It aggregates hunting tools, Yara rules, beacon configuration parsers, JARM fingerprinting resources, and MITRE ATT&CK references.", "when_to_avoid": ["you want an offensive tool or a way to run Cobalt Strike itself", "you need a single maintained detection product rather than a list of links", "you are defending against C2 frameworks other than Cobalt Strike"], "when_to_choose": ["you are a blue teamer or incident responder investigating suspected Cobalt Strike activity", "you need a starting point for building detection and hunting capabilities against C2 frameworks", "you want a curated index of beacon scanning, Yara, and forensic tools"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/awesome-cobaltstrike-defence", "repo": "MichaelKoczwara/Awesome-CobaltStrike-Defence", "role": "main", "score": 32}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:04:17.614485+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T04:52:13.408666+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "0a9e82ff8c2d227909a01b35dc608de728fbb37acddfca9c870e9186d03ecd4b", "fetched_at": "2026-08-28T04:04:17.614485+00:00", "kind": "readme", "missing": false, "url": "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:04:17.614485+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T04:52:13.408666+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "0a9e82ff8c2d227909a01b35dc608de728fbb37acddfca9c870e9186d03ecd4b", "fetched_at": "2026-08-28T04:04:17.614485+00:00", "kind": "readme", "missing": false, "url": "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T04:52:13.408666+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "0a9e82ff8c2d227909a01b35dc608de728fbb37acddfca9c870e9186d03ecd4b", "fetched_at": "2026-08-28T04:04:17.614485+00:00", "kind": "readme", "missing": false, "url": "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:04:17.614485+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:04:17.614485+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:04:17.614485+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T04:52:13.408666+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "0a9e82ff8c2d227909a01b35dc608de728fbb37acddfca9c870e9186d03ecd4b", "fetched_at": "2026-08-28T04:04:17.614485+00:00", "kind": "readme", "missing": false, "url": "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:04:17.614485+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:04:17.614485+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T04:52:13.408666+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "0a9e82ff8c2d227909a01b35dc608de728fbb37acddfca9c870e9186d03ecd4b", "fetched_at": "2026-08-28T04:04:17.614485+00:00", "kind": "readme", "missing": false, "url": "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:04:17.614485+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:04:17.614485+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:04:17.614485+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T04:52:13.408666+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "0a9e82ff8c2d227909a01b35dc608de728fbb37acddfca9c870e9186d03ecd4b", "fetched_at": "2026-08-28T04:04:17.614485+00:00", "kind": "readme", "missing": false, "url": "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:04:17.614485+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:04:17.614485+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T04:52:13.408666+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "0a9e82ff8c2d227909a01b35dc608de728fbb37acddfca9c870e9186d03ecd4b", "fetched_at": "2026-08-28T04:04:17.614485+00:00", "kind": "readme", "missing": false, "url": "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T04:52:13.408666+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "0a9e82ff8c2d227909a01b35dc608de728fbb37acddfca9c870e9186d03ecd4b", "fetched_at": "2026-08-28T04:04:17.614485+00:00", "kind": "readme", "missing": false, "url": "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T04:52:13.408666+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "0a9e82ff8c2d227909a01b35dc608de728fbb37acddfca9c870e9186d03ecd4b", "fetched_at": "2026-08-28T04:04:17.614485+00:00", "kind": "readme", "missing": false, "url": "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T04:52:13.408666+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "0a9e82ff8c2d227909a01b35dc608de728fbb37acddfca9c870e9186d03ecd4b", "fetched_at": "2026-08-28T04:04:17.614485+00:00", "kind": "readme", "missing": false, "url": "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-02T17:46:02.011165+00:00", "flags": ["no_releases"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 2070, "days_push": 1511, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 32, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}