dissect.cobaltstrike 1.2.1.dev11__tar.gz → 1.2.1.dev13__tar.gz

{dissect_cobaltstrike-1.2.1.dev11 → dissect_cobaltstrike-1.2.1.dev13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.cobaltstrike
-Version: 1.2.1.dev11
+Version: 1.2.1.dev13
 Summary: a Python library for dissecting Cobalt Strike related data
 Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
 Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/

{dissect_cobaltstrike-1.2.1.dev11 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/_version.py

@@ -17,5 +17,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '1.2.1.dev11'
-__version_tuple__ = version_tuple = (1, 2, 1, 'dev11')
+__version__ = version = '1.2.1.dev13'
+__version_tuple__ = version_tuple = (1, 2, 1, 'dev13')

{dissect_cobaltstrike-1.2.1.dev11 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/beacon.py

@@ -1198,10 +1198,11 @@ def main():
             if args.verbose >= 1:
                 print("-" * 50)
                 print(
-                    "pe_export_stamp = {}, {}, {}".format(
+                    "pe_export_stamp = {}, {}, {} - {}".format(
                         config.pe_export_stamp,
                         hex(config.pe_export_stamp),
                         time.ctime(config.pe_export_stamp),
+                        config.version,
                     )
                 )
                 print(

{dissect_cobaltstrike-1.2.1.dev11 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/guardrails.py

@@ -2,15 +2,16 @@
 This module is responsible for finding and recovering Beacon Guardrails configuration from Cobalt Strike payloads.
 Guardrails is an additional layer of protection to the beacon config by using environmental keying (`T1480`_).
 
-Beacon Guardrails was introduced in Cobalt Strike 4.8:
+.. note::
+    Beacon Guardrails was introduced in Cobalt Strike 4.8:
 
- - https://www.cobaltstrike.com/blog/cobalt-strike-4-8-system-call-me-maybe
+    - https://www.cobaltstrike.com/blog/cobalt-strike-4-8-system-call-me-maybe
 
-Other research on Beacon Guardrails:
+    Other research on Beacon Guardrails:
 
- - https://itea.org/journals/volume-45-3/cobalt-strike-cyber-assessment-challenge/
+    - https://itea.org/journals/volume-45-3/cobalt-strike-cyber-assessment-challenge/
 
-.. _T1480: https://attack.mitre.org/techniques/T1480/
+    .. _T1480: https://attack.mitre.org/techniques/T1480/
 """
 
 from __future__ import annotations

{dissect_cobaltstrike-1.2.1.dev11 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/version.py

@@ -87,6 +87,10 @@ PE_EXPORT_STAMP_TO_VERSION: Dict[int, str] = {
     0x66915020: "Cobalt Strike 4.10 (Jul 16, 2024)",
     0x66915022: "Cobalt Strike 4.10 (Jul 16, 2024)",
     0x66915024: "Cobalt Strike 4.10 (Jul 16, 2024)",
+    0x66915027: "Cobalt Strike 4.10 (Jul 16, 2024)",
+    0x674E0D02: "Cobalt Strike 4.10.1 (Dec 10, 2024)",
+    0x674E0D13: "Cobalt Strike 4.10.1 (Dec 10, 2024)",
+    0x674E0D17: "Cobalt Strike 4.10.1 (Dec 10, 2024)",
 }
 """ PE export timestamp to Cobalt Strike version mapping """
 

dissect_cobaltstrike-1.2.1.dev13/docs/structures/guardrails_def.rst

@@ -0,0 +1,8 @@
+:attr:`dissect.cobaltstrike.guardrails.C_GUARDRAILS_DEF`
+----------------------------------------
+Structures for parsing Beacon Guardrails metadata.
+
+.. literalinclude:: ../../dissect/cobaltstrike/guardrails.py
+        :start-after: C_GUARDRAILS_DEF
+        :end-before: """
+        :language: c

{dissect_cobaltstrike-1.2.1.dev11 → dissect_cobaltstrike-1.2.1.dev13}/docs/structures/index.rst

@@ -12,3 +12,4 @@ Structure definitions
    cs_def
    pe_def
    c2_def
+   guardrails_def