Explore >> Select a destination


You are here

www.codeproject.com
| | forensicitguy.github.io
5.0 parsecs away

Travel
| | In this post I want to take a look at a PowerShell-based Cobalt Strike beacon that appeared on MalwareBazaar. This particular beacon is representative of most PowerShell Cobalt Strike activity I see in the wild during my day job. The beacons often show up as service persistence during incidents or during other post-exploitation activity. If you want to follow along at home, the sample I'm using is here:
| | usualsuspect.re
5.5 parsecs away

Travel
| |
| | 0xcybery.github.io
4.6 parsecs away

Travel
| | Bypass Windows Defender in Windows 11.
| | int10h.org
13.9 parsecs away

Travel
| Font: DOS/V re. JPN30, from the world's biggest collection of classic text mode fonts, system fonts and BIOS fonts from DOS-era IBM PCs and compatibles