dissect.cobaltstrike 1.2.1.dev3__tar.gz → 1.2.1.dev4__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (66) hide show
  1. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/PKG-INFO +1 -1
  2. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/_version.py +2 -2
  3. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/version.py +8 -0
  4. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/.github/workflows/dissect-ci.yml +0 -0
  5. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/.gitignore +0 -0
  6. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/.lfs-assets-id +0 -0
  7. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/.pre-commit-config.yaml +0 -0
  8. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/.readthedocs.yml +0 -0
  9. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/LICENSE +0 -0
  10. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/README.rst +0 -0
  11. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/codecov.yml +0 -0
  12. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/__init__.py +0 -0
  13. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/artifact.py +0 -0
  14. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/beacon.py +0 -0
  15. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/c2.py +0 -0
  16. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/c2profile.lark +0 -0
  17. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/c2profile.py +0 -0
  18. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/c_c2.py +0 -0
  19. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/client.py +0 -0
  20. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/pcap.py +0 -0
  21. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/pe.py +0 -0
  22. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/utils.py +0 -0
  23. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/xordecode.py +0 -0
  24. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/Makefile +0 -0
  25. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/c2profile-grammar.rst +0 -0
  26. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/codespell-ignore-words.txt +0 -0
  27. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/conf.py +0 -0
  28. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/examples.rst +0 -0
  29. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/images/beacon-client.png +0 -0
  30. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/images/teamserver-echoclient.png +0 -0
  31. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/images/teamserver_ls.png +0 -0
  32. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/images/vt-cobaltstrike-43-zip.png +0 -0
  33. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/index.rst +0 -0
  34. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/installation.rst +0 -0
  35. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/license.rst +0 -0
  36. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/scripts/checksum8-accesslogs.rst +0 -0
  37. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/scripts/dump_beacon_keys.rst +0 -0
  38. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/scripts/example_client.rst +0 -0
  39. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/scripts/index.rst +0 -0
  40. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/structures/c2_def.rst +0 -0
  41. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/structures/cs_def.rst +0 -0
  42. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/structures/index.rst +0 -0
  43. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/structures/pe_def.rst +0 -0
  44. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/tools/beacon-artifact.rst +0 -0
  45. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/tools/beacon-client.rst +0 -0
  46. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/tools/beacon-dump.rst +0 -0
  47. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/tools/beacon-pcap.rst +0 -0
  48. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/tools/beacon-xordecode.rst +0 -0
  49. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/tools/c2profile-dump.rst +0 -0
  50. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/tutorials/decrypt_cobaltstrike_pcaps.rst +0 -0
  51. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/tutorials/index.rst +0 -0
  52. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/docs/tutorials/minimal_beacon_client.rst +0 -0
  53. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/pyproject.toml +0 -0
  54. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/scripts/checksum8-accesslogs.py +0 -0
  55. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/scripts/dump_beacon_keys.py +0 -0
  56. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/scripts/example_client.py +0 -0
  57. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/tests/conftest.py +0 -0
  58. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/tests/test_beacon.py +0 -0
  59. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/tests/test_c2.py +0 -0
  60. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/tests/test_c2profile.py +0 -0
  61. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/tests/test_client.py +0 -0
  62. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/tests/test_pe.py +0 -0
  63. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/tests/test_utils.py +0 -0
  64. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/tests/test_version.py +0 -0
  65. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/tests/test_xordecode.py +0 -0
  66. {dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/tox.ini +0 -0
{dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/PKG-INFO RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.3
2
2
  Name: dissect.cobaltstrike
3
- Version: 1.2.1.dev3
3
+ Version: 1.2.1.dev4
4
4
  Summary: a Python library for dissecting Cobalt Strike related data
5
5
  Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
6
6
  Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/
{dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/_version.py RENAMED
@@ -12,5 +12,5 @@ __version__: str
12
12
  __version_tuple__: VERSION_TUPLE
13
13
  version_tuple: VERSION_TUPLE
14
14
 
15
- __version__ = version = '1.2.1.dev3'
16
- __version_tuple__ = version_tuple = (1, 2, 1, 'dev3')
15
+ __version__ = version = '1.2.1.dev4'
16
+ __version_tuple__ = version_tuple = (1, 2, 1, 'dev4')
{dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/version.py RENAMED
@@ -32,6 +32,8 @@ MAX_ENUM_TO_VERSION: Dict[int, str] = {
32
32
  70: "Cobalt Strike 4.3 (Mar 03, 2021)",
33
33
  73: "Cobalt Strike 4.5 (Dec 14, 2021)",
34
34
  74: "Cobalt Strike 4.7 (Aug 17, 2022)",
35
+ 76: "Cobalt Strike 4.9 (Sep 19, 2023)",
36
+ 78: "Cobalt Strike 4.10 (Jul 16, 2024)",
35
37
  }
36
38
  """ Max setting enum to Cobalt Strike version mapping """
37
39
 
@@ -77,6 +79,12 @@ PE_EXPORT_STAMP_TO_VERSION: Dict[int, str] = {
77
79
  0x63EE0552: "Cobalt Strike 4.8 (Feb 28, 2023)",
78
80
  0x63EE056C: "Cobalt Strike 4.8 (Feb 28, 2023)",
79
81
  0x63EE0587: "Cobalt Strike 4.8 (Feb 28, 2023)",
82
+ 0x64F88C5E: "Cobalt Strike 4.9 (Sep 19, 2023)",
83
+ 0x64F88C9E: "Cobalt Strike 4.9 (Sep 19, 2023)",
84
+ 0x64F88CDE: "Cobalt Strike 4.9 (Sep 19, 2023)",
85
+ 0x6691500F: "Cobalt Strike 4.10 (Jul 16, 2024)",
86
+ 0x66915020: "Cobalt Strike 4.10 (Jul 16, 2024)",
87
+ 0x66915022: "Cobalt Strike 4.10 (Jul 16, 2024)",
80
88
  }
81
89
  """ PE export timestamp to Cobalt Strike version mapping """
82
90