Kali Linux

BeaconEye : Hunts Out CobaltStrike Beacons And Logs Operator Command Output

BeaconEye scans running processes for active Cobalt Strike beacons. When processes are found to be running beacon, BeaconEye will monitor each process for C2 activity.

How It Works

BeaconEye will scan live processes or MiniDump files for suspected CobaltStrike beacons. In live process mode, BeaconEye optionally attaches itself as a debugger and will begin monitoring beacon activity for C2 traffic (HTTP/HTTPS beacons supported currently).

The AES keys used for encrypting C2 data and mallable profile are decoded on the fly, which enables BeaconEye to extract and decrypt beacon’s output when commands are sent via the operator.

A log folder of activity is created per process relative to the current directory where BeaconEye is executed from.

Usage

BeconEye by @EthicalChaos
CobaltStrike beacon hunter and command monitoring tool x86_64
-v, –verbose Display more verbose output instead of just
information on beacons found
-m, –monitor Attach to and monitor beacons found when scanning
live processes
-f, –filter=VALUE Filter process list with names starting with x (
live mode only)
-d, –dump=VALUE A folder to use for MiniDump mode to scan for
beacons (files with *.dmp or *.mdmp)
-h, –help Display this help

Features

  • A per process log folder
  • Dumps beacon config
  • Displays output from most beacon commands
  • Saves screenshots
  • Detects standalone and injected beacons
  • Detects beacons masked with built in sleep_mask
  • Scan running processes or Minidumps offline

Caveats

BeaconEye can detect all beacon types but only monitor HTTP/HTTPS beacons. At present, only command output is decoded and not command requests. See TODO list below for a full list of intended features.

BeaconEye should be considered ALPHA, I’m keen to get feedback on 4.x beacons that cannot be detected or where the malleable C2 profile has not been parsed correctly resulting in incorrect decoding of output.

R K

Recent Posts

SpyAI : Intelligent Malware With Advanced Capabilities

SpyAI is a sophisticated form of malware that leverages advanced technologies to capture and analyze…

24 hours ago

Proxmark3 : The Ultimate Tool For RFID Security And Analysis

The Proxmark3 is a versatile, open-source tool designed for radio-frequency identification (RFID) security analysis, research,…

24 hours ago

Awesome Solana Security : Enhancing Program Development

The "Awesome Solana Security" collection is a comprehensive resource designed to help developers build more…

24 hours ago

IngressNightmare-POCs : Understanding The Vulnerability Exploitation Flow

The "IngressNightmare" vulnerabilities, disclosed in March 2025, represent a critical set of security issues affecting…

1 day ago

AdaptixC2 : Enhancing Penetration Testing With Advanced Framework Capabilities

AdaptixC2 is an advanced post-exploitation and adversarial emulation framework designed specifically for penetration testers. It…

1 day ago

Bincrypter : Enhancing Linux Binary Security through Runtime Encryption And Obfuscation

Bincrypter is a powerful Linux binary runtime crypter written in BASH. It is designed to…

1 day ago