https://www.veil-framework.com/component---src-components-page-tem…t-strike-beacon-mdx-2973a187dbba537cb3a1.js

1"use strict";(self.webpackChunkveil_framework=self.webpackChunkveil_framework||[]).push([[2430],{7304:function(e,t,n){n.d(t,{A:function(){return r}});var a=n(6540);function l({href:e,children:t,className:n,...l}){return a.createElement("a",Object.assign({href:e,target:"_blank",rel:"sponsored nofollow noopener",className:n},l),t)}function r(){const e="/veil-recommends/infosec-fundamentals";return a.createElement("aside",{className:"fc-wrap","aria-label":"Recommended course"},a.createElement("div",{className:"fc-header"},a.createElement("span",{className:"fc-dot fc-dot-r","aria-hidden":"true"}),a.createElement("span",{className:"fc-dot fc-dot-a","aria-hidden":"true"}),a.createElement("span",{className:"fc-dot fc-dot-g","aria-hidden":"true"}),a.createElement("span",{className:"fc-header-label"},"course_spotlight.sh")),a.createElement(l,{href:e,className:"fc-image-link","aria-label":"View Information Security Fundamentals course"},a.createElement("img",{src:"/img/hero/infosec-fundamentals.webp",alt:"Information Security Fundamentals course cover",className:"fc-image",loading:"lazy",width:"300",height:"169"})),a.createElement("div",{className:"fc-body"},a.createElement("div",{className:"fc-tag"},"Recommended Course"),a.createElement("h3",{className:"fc-title"},a.createElement(l,{href:e,className:"fc-title-link"},"Information Security Fundamentals")),a.createElement("p",{className:"fc-desc"},"Build a solid foundation in cybersecurity. Covers network fundamentals, common attack vectors, defensive controls, and the mindset needed for security research."),a.createElement("ul",{className:"fc-features"},a.createElement("li",{className:"fc-feature"},a.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Beginner-friendly — no prior experience needed"),a.createElement("li",{className:"fc-feature"},a.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Network attacks & defences"),a.createElement("li",{className:"fc-feature"},a.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Real-world security concepts")),a.createElement(l,{href:e,className:"fc-cta"},"View Course",a.createElement("span",{className:"fc-cta-arrow","aria-hidden":"true"}," →")),a.createElement("p",{className:"fc-disclosure"},"We may earn a commission if you enrol via our link, at no extra cost to you.")))}},8453:function(e,t,n){n.d(t,{RP:function(){return r}});var a=n(6540);const l=a.createContext({});function r(e){const t=a.useContext(l);return a.useMemo(()=>"function"==typeof e?e(t):{...t,...e},[t,e])}},8752:function(e,t,n){n.d(t,{A:function(){return l}});var a=n(6540);function l({sourceUrl:e}){const{0:t,1:n}=(0,a.useState)("idle"),{0:l,1:r}=(0,a.useState)("");return a.createElement("aside",{className:"nl-sw-wrap","aria-label":"Newsletter signup"},a.createElement("div",{className:"nl-sw-header"},a.createElement("span",{className:"nl-sw-dot nl-sw-dot-r","aria-hidden":"true"}),a.createElement("span",{className:"nl-sw-dot nl-sw-dot-a","aria-hidden":"true"}),a.createElement("span",{className:"nl-sw-dot nl-sw-dot-g","aria-hidden":"true"}),a.createElement("span",{className:"nl-sw-title"},"intel_feed.sh")),a.createElement("div",{className:"nl-sw-body"},a.createElement("p",{className:"nl-sw-prompt"},a.createElement("span",{className:"nl-sw-caret","aria-hidden":"true"},"$")," ","subscribe --to evasion-intel"),a.createElement("h3",{className:"nl-sw-heading"},"Stay ahead of the curve"),a.createElement("p",{className:"nl-sw-desc"},"AV bypass techniques, detection gaps, and lab-tested research — delivered before the mainstream catches up."),"done"===t?a.createElement("div",{className:"nl-sw-success",role:"status"},a.createElement("span",{className:"nl-sw-check","aria-hidden":"true"},"✓"),a.createElement("div",null,a.createElement("strong",null,"Subscribed."),a.createElement("br",null),a.createElement("span",{className:"nl-sw-success-sub"},"Confirm your email to activate."))):a.createElement("form",{onSubmit:async function(e){e.preventDefault();const t=e.currentTarget,a=new FormData(t);if(!a.get("company")){n("loading"),r("");try{const e=await fetch("/api/subscribe",{method:"POST",body:a}),l=await e.json();l.success?(n("done"),t.reset()):(n("err"),r(l.error||"Something went wrong."))}catch{n("err"),r("Network error — please try again.")}}},className:"nl-sw-form",noValidate:!0},a.createElement("input",{type:"hidden",name:"site",value:"veil-framework"}),a.createElement("input",{type:"hidden",name:"source_url",value:e||""}),a.createElement("input",{type:"text",name:"company",tabIndex:"-1","aria-hidden":"true",className:"nl-sw-hp",autoComplete:"off"}),a.createElement("label",{htmlFor:"nl-sw-name",className:"nl-sw-label"},"Your name"),a.createElement("input",{id:"nl-sw-name",type:"text",name:"name",placeholder:"alias or handle",required:!0,autoComplete:"given-name",className:"nl-sw-input",disabled:"loading"===t}),a.createElement("label",{htmlFor:"nl-sw-email",className:"nl-sw-label"},"Email address"),a.createElement("input",{id:"nl-sw-email",type:"email",name:"email",placeholder:"[email protected]",required:!0,autoComplete:"email",className:"nl-sw-input",disabled:"loading"===t}),"err"===t&&a.createElement("p",{className:"nl-sw-error",role:"alert"},l),a.createElement("button",{type:"submit",className:"nl-sw-btn",disabled:"loading"===t},"loading"===t?"Connecting…":"Subscribe to intel →"),a.createElement("p",{className:"nl-sw-legal"}

1,"No spam. No vendor fluff. Unsubscribe any time."))))}},8963:function(e,t,n){n.d(t,{A:function(){return l}});var a=n(6540);function l({title:e,subtitle:t,primaryLink:n,primaryText:l,secondaryLink:r,secondaryText:i,backgroundImage:s}){const c=s?{backgroundImage:`linear-gradient(135deg, rgba(37, 99, 235, 0.85) 0%, rgba(13, 33, 55, 0.9) 100%), url(${s})`,backgroundSize:"cover",backgroundPosition:"center"}:{};return a.createElement("section",{className:"hero blueprint-section-subtle",style:c},a.createElement("div",{className:"container"},a.createElement("h1",null,e),t&&a.createElement("p",null,t),(n||r)&&a.createElement("div",{style:{display:"flex",gap:"var(--space-md)",flexWrap:"wrap"}},n&&a.createElement("a",{href:n,className:"btn btn-primary"},l||"Get Started"),r&&a.createElement("a",{href:r,className:"btn btn-outline"},i||"Learn More"))))}},9144:function(e,t,n){n.r(t),n.d(t,{Head:function(){return h},default:function(){return f}});var a=n(8453),l=n(6540);function r(e){const t=Object.assign({h1:"h1",p:"p",h2:"h2",h3:"h3",ul:"ul",li:"li",strong:"strong",ol:"ol",a:"a"},(0,a.RP)(),e.components);return l.createElement(l.Fragment,null,l.createElement(t.h1,null,"Detecting Cobalt Strike Beacon Activity with Veil"),"\n",l.createElement(t.p,null,"Cobalt Strike is one of the most widely used commercial adversary simulation tools, and its Beacon implant is frequently encountered in both authorized red team exercises and real-world intrusions. Understanding how Beacon operates — and specifically how to detect it — is a critical skill for defensive security teams."),"\n",l.createElement(t.p,null,"This page examines Beacon from a detection perspective: network indicators, endpoint telemetry, memory forensics, and the hunting techniques that reveal C2 activity. We frame this as a defensive exercise because that is where the value lies — not in operating the tool, but in finding it operating against you."),"\n",l.createElement(t.h2,null,"Why Beacon Detection Matters"),"\n",l.createElement(t.p,null,"Beacon-style implants represent the standard for modern command-and-control (C2) infrastructure. They use techniques like sleep intervals, jitter, malleable profiles, and encrypted channels that make traditional detection approaches (static signatures, simple network indicators) unreliable."),"\n",l.createElement(t.p,null,"If your SOC cannot detect a Beacon in your environment, you likely cannot detect any sophisticated C2. This makes Beacon detection a useful benchmark for your overall detection maturity."),"\n",l.createElement(t.h2,null,"Network-Level Detection"),"\n",l.createElement(t.h3,null,"HTTP/HTTPS Indicators"),"\n",l.createElement(t.p,null,"Beacon typically communicates over HTTP or HTTPS. Default configurations have recognizable patterns, but malleable profiles can customize virtually every aspect of the network traffic. Focus on:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"JA3/JA3S fingerprints")," — TLS handshake patterns that can identify Beacon even through encrypted traffic"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Beacon timing analysis")," — Regular intervals with consistent jitter are detectable through traffic analysis"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"URI patterns")," — Default profiles use characteristic URI structures"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"HTTP header anomalies")," — Custom headers or unusual header combinations"),"\n"),"\n",l.createElement(t.h3,null,"DNS Indicators"),"\n",l.createElement(t.p,null,"DNS-based Beacon communication uses TXT or A records for data exfiltration:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,"High-volume DNS queries to a 

1single domain"),"\n",l.createElement(t.li,null,"Unusually long subdomain labels (data encoding)"),"\n",l.createElement(t.li,null,"DNS queries that do not match legitimate application behavior"),"\n"),"\n",l.createElement(t.h3,null,"Named Pipe Indicators"),"\n",l.createElement(t.p,null,"Beacon uses named pipes for peer-to-peer communication:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,"Default pipe names have known patterns"),"\n",l.createElement(t.li,null,"SMB traffic between workstations (unusual in most environments)"),"\n",l.createElement(t.li,null,"Pipe creation events visible through Sysmon Event ID 17/18"),"\n"),"\n",l.createElement(t.h2,null,"Endpoint Telemetry"),"\n",l.createElement(t.h3,null,"Process Behavior"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Process injection")," — Beacon frequently migrates into legitimate processes; Sysmon Event ID 8 (CreateRemoteThread) captures this"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Spawning patterns")," — Default behaviors include spawning rundll32.exe or dllhost.exe"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Memory-only execution")," — No file on disk, but process telemetry still captures execution"),"\n"),"\n",l.createElement(t.h3,null,"Memory Forensics"),"\n",l.createElement(t.p,null,"Memory analysis is the most reliable detection method for in-memory implants:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,"Scan for known Beacon shellcode patterns in process memory"),"\n",l.createElement(t.li,null,"Look for injected threads in processes that should not have them"),"\n",l.createElement(t.li,null,"Identify reflectively loaded DLLs without corresponding file-backed sections"),"\n"),"\n",l.createElement(t.h2,null,"Hunting Techniques"),"\n",l.createElement(t.p,null,"Structured hunting for Beacon activity:"),"\n",l.createElement(t.ol,null,"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Network traffic pattern analysis")," — Look for regular callback intervals across all outbound connections"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Process genealogy review")," — Identify processes with suspicious parent-child relationships"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Named pipe enumeration")," — Catalog all named pipes and identify anomalous ones"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Service creation review")," — Check for recently created services with unusual binaries"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Scheduled task analysis")," — Review tasks created around the time of suspected compromise"),"\n"),"\n",l.createElement(t.h2,null,"Lab Exercise: Detection Validation"),"\n",l.createElement(t.p,null,"In your lab environment, test detection of C2 patterns by:"),"\n",l.createElement(t.ol,null,"\n",l.createElement(t.li,null,"Configuring comprehensive logging (Sysmon, PowerShell, network capture)"),"\n",l.createElement(t.li,null,"Establishing a baseline of normal traffic patterns"),"\n",l.createElement(t.li,null,"Introducing C2-pattern activity"),"\n",l.createElement(t.li,null,"Verifying that your detection stack identifies the key indicators"),"\n",l.createElement(t.li,null,"Tuning detection rules based on findings"),"\n"),"\n",l.createElement(t.p,null,"This exercise validates whether your organization can detect the specific techniques used by the most common adversary simulation tools."),"\n",l.createElement(t.h2,null,"Related"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/framework/veil-evasion/"},"Veil-Evasion"))," — Payload generation and detection testing"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/veil-evasion-cortana-integration/"},"Veil-Evasion Cortana Integration"))," — Automating payload generation through Cobalt Strike's Cortana scripting engine"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/hunting-sensitive-data-veil-framework/"},"Hunting Sensitive Data"))," — Data discovery detection"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/hunting-users-veil-framework/"},"Hunting Users"))," — User enumeration detection"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/guides/"},"Guides"))," — All available guides"),"\n"))}var i=function(e={}){const{wrapper:t}=Object.assign({},(0,a.RP)(),e.components);return t?l.createElement(t,e,l.createElement(r,e)):r(e)},s=n(9329),c=n(1744),o=n(8963),m=n(8752),u=n(7304);function d(e){if(!e)return null;try{return new Intl.DateTimeFormat("en-GB",{day:"numeric",month:"long",year:"numeric",timeZone:"UTC"}).format(new Date(e))}catch{return null}}function p({pageContext:e,children:t}){const{frontmatter:n}=e,a=(null==n?void 0:n.title)||"",r=(null==n?void 0:n.description)||"",i=(null==n?void 0:n.slug)||"",c=(null==n?void 0:n.heroImage)||null,p=(null==n?void 0:n.date)||null,f=(null==n?void 0:n.lastmod)||null,h=d(p),E=f&&f!==p?d(f):null;return l.createElement(s.A,null,c&&l.createElement(o.A,{title:a,subtitle:r,backgroundImage:c}),l.createElement("article",{className:"page-content"},l.createElement("div",{className:"container"},h&&l.createElement("p",{className:"post-meta"},l.createElement("time",{dateTime:p},"Published ",h),E&&l.createElement(l.Fragment,null," · ",l.createElement("time",{dateTime:f},"Updated ",E))),l.createElement("div",{className:"post-layout-grid"},l.createElement("div",{className:"post-main"},t),l.createElement("aside",{className:"post-sidebar","aria-label":"Sidebar"},l.createElement("div",{className:"post-sidebar-scroll"},l.createElement(u.A),l.createElement(m.A,{sourceUrl:i})))))))}function f(e){return l.createElement(p,e,l.createElement(i,e))}function h({pageContext:e}){const{frontmatter:t}=e,n=null!=t&&t.heroImage?`https://www.veil-framework.com${t.heroImage}`:null;

1return l.createElement(c.A,{title:null==t?void 0:t.title,description:null==t?void 0:t.description,pathname:null==t?void 0:t.slug},(null==t?void 0:t.date)&&l.createElement("meta",{property:"article:published_time",content:t.date}),(null==t?void 0:t.lastmod)&&l.createElement("meta",{property:"article:modified_time",content:t.lastmod}),n&&l.createElement("meta",{property:"og:image",content:n}),n&&l.createElement("meta",{name:"twitter:image",content:n}))}}}]);
2//# sourceMappingURL=component---src-components-page-template-jsx-content-file-path-content-posts-cobalt-strike-beacon-mdx-2973a187dbba537cb3a1.js.map