Hands-On Red Team Tactics

Beacons

Beacons is a payload used by Cobalt Strike. It is flexible and supports both asynchronous and interactive modes of communication.The asynchronous mode can be quite slow. In this mode, the beacon calls home every once in a while, receives a list of the tasks that are assigned to it, downloads them, and goes back to sleep. This helps in avoiding detection on the remote system. In interactive mode, however, everything happens in real time. Beacons have malleable network indicators, which means they have a Malleable C2 profile. This is responsible for transporting the data, transforming it for storage, and reinterpreting it backwards. We will learn more about this in the later chapters of this book. For now, let's look at the different ...