Sentinel-One/CobaltStrikeParser

Health v2 · maintenance only

Flags: no_releases archived no_license

Adoption not part of the score

1138 stars · 193 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Python parser that extracts Cobalt Strike Beacon configuration from stageless PE files, memory dumps, or C2 URLs. It heuristically finds and decrypts XOR-encrypted beacon data and can also be used as a library, with an optional module for emulating beacon communication with a C2 server.

Use cases

• extract cobalt strike beacon config from a malware sample
• parse beacon configuration from a memory dump
• pull C2 settings from a stageless beacon PE
• analyze a suspected C2 URL for beacon config
• automate beacon config extraction in a threat intel pipeline
• emulate beacon traffic to a C2 server for research

When to choose

• you need to extract Cobalt Strike Beacon configurations programmatically or via CLI
• you're doing malware analysis or threat intelligence on Cobalt Strike samples
• you want a Python library to integrate beacon config parsing into your tooling

When to avoid

• you need a general-purpose malware analysis sandbox
• you're analyzing malware families other than Cobalt Strike
• you need actively maintained tooling with recent updates and support

Facets

library · maturity maintenance

parser security reverse-engineering cli security reverse-engineering python cli cross-platform cobalt-strike beacon-config malware-analysis threat-intelligence c2-extraction pe-parsing

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Sentinel-One/CobaltStrikeParser")