Cobalt Strike Beacon used by NOBELIUM; Cobalt Strike network infrastructure used by NOBELIUM; The following alerts might also indicate threat activity associated with this threat. These alerts, however, can be triggered by unrelated threat activity and are not monitored in the status cards provided with this report.Beacon is Cobalt Strike’s payload to model advanced attackers. Use Beacon to egress a network over HTTP, HTTPS, or DNS. You may also limit which hosts egress a network by controlling peer- to-peer Beacons over Windows named pipes and TCP sockets. Beacon is flexible and supports asynchronous and interactive communication.My Favorite PowerShell Post-Exploitation Tools. Wednesday 25 February, 2015. PowerShell became a key part of my red team toolkit in 2014. Cobalt Strike 2.1 added PowerShell support to the Beacon payload and this has made an amazing library of capability available to my users. In this post, I’d like to take you through a few …Cobalt Strike is commercial threat emulation software that emulates a quiet, long-term embedded actor in a network. This actor, known as Beacon, communicates …i春秋. 上周更新了Cobalt Strike系列教程第一章：简介与安装，文章发布后，深受大家的喜爱，遂将该系列教程的其他章节与大家分享，提升更多实用技能！. 第二章：Beacon详解. 一、Beacon命令. 大家通过上一篇内容的学习，配置好Listner，执行我们的Payload后，即可 ...This post, from Ernesto Alvarez Capandeguy of Core Security’s CoreLabs Research Team, describes techniques used for creating UDP redirectors for protecting Cobalt Strike team servers. This is one of the recommended mechanisms for hiding Cobalt Strike team servers and involves adding different points which a Beacon can contact for …The Cobalt Strike beacon loader gets decrypted into a memory buffer and executed with the help of a known trick. Instead of calling the beacon loader directly, the loader uses the Windows API function EnumChildWindows to run it. This function contains three parameters, one of which is a callback function. This parameter can be abused by …May 16, 2023. 08:10 AM. 2. Geacon, a Go-based implementation of the beacon from the widely abused penetration testing suite Cobalt Strike, is being used more and more to target macOS devices. Both ...May 6, 2022 · Cobalt Strike is commercial threat emulation software that emulates a quiet, long-term embedded actor in a network. This actor, known as Beacon, communicates with an external team server to emulate command and control (C2) traffic. Due to its versatility, Cobalt Strike is commonly used as a legitimate tool by red teams – but is also widely ... Exploring Cobalt Strike’s Beacon instructions. All the evidence suggests that beacon.dll is the Cobalt Strike Beacon malware. To understand what this malware is capable of; we analysed the DLL further. At the core of beacon.dll is a large switch statement containing cases to handle the client-side execution of C2 commands, shown in Figure 9.Nov 28, 2022 · Google’s rules include 165 signatures covering 34 different Cobalt Strike versions, each with 10 to 100 attack templates and typically unique Beacon components. Who uses Cobalt Strike? While ... If a Cobalt Strike beacon is returned, we store the data ready for ingest into our database. Figure 2 Example of an extracted Cobalt Strike beacon. Now that we have discussed a methodology to identify Cobalt Strike Team Servers and carve out beacon configs, we need somewhere to ingest the data to begin hunting. ...Nov 18, 2020 · Cobalt Strike, though, hides shellcode over a named pipe. ... The Malleable C2 module in Cobalt Strike is an advanced tool that allows attackers to customize beacon traffic and create covert ... Redefine Beacon's communication with Cobalt Strike's malleable C2 language. This allows you to cloak Beacon activity to look like other malware or blend-in as legitimate traffic. The Beacon Console. Right-click on a Beacon session and select interact to open that Beacon’s console. The console is the main user interface for your Beacon session.Dec 2, 2022 · The Cobalt Strike beacon loader gets decrypted into a memory buffer and executed with the help of a known trick. Instead of calling the beacon loader directly, the loader uses the Windows API function EnumChildWindows to run it. This function contains three parameters, one of which is a callback function. May 11, 2020 · Key Points. 1. Progression: The attack propogated initially through the company’s VPN to an inner Windows server, and then on to the Domain Controller and afterward to servers containing the sought-after data. 2. Toolkit: The attackers used a CobaltStrike beacon with a then-unknown persistence method using DLL hijacking (detailed below). Cobalt Strike is a commercial threat emulation platform designed to provide long-term, covert command-and-control (C2) communication between Beacon agents …Cobalt Strike helps organizations conduct advanced adversary simulations and Red Team engagements with ease, allowing your organization to effectively measure your security operations program and incident response capabilities. This on-demand Cobalt Strike demo includes a guided walkthrough of using Cobalt Strike in a small cyber range.Signaturing Cobalt Strike. Cobalt Strike is a popular framework for conducting red team operations and adversary simulation. Presumably due to its ease of use, stability, and stealth features, it is also a favorite tool for bad actors with even more nefarious intentions. There have been various techniques for detecting Beacon, Cobalt …Cobalt Strike, though, hides shellcode over a named pipe. ... The Malleable C2 module in Cobalt Strike is an advanced tool that allows attackers to customize beacon traffic and create covert ...Jul 12, 2021 · Cobalt Strike is a commercial tool that security professionals use to test the security of networks and systems. It includes a Beacon payload that allows remote control and monitoring, and can be used for malicious purposes by cybercriminals. Cobalt Strike is a premium offensive security tool leveraged by penetration testers and red team members as a way to emulate adversary behavior. The goal is to validate security detection capabilities and processes replicating a real-world intrusion. While Cobalt Strike is a legitimate tool, it is often abused by actual threat actors as a …Cobalt Strike does not provide a way to override the default macro attack. Fortunately, its choice of rundll32.exe is a string inside of the macro that you can edit. If this choice does not work for you, change this to another process. Many times, I have edited Cobalt Strike’s VBA macro to spawn Internet Explorer and inject my stager into it.CobaltStrike Beacons tend to be encrypted using a 4-byte XOR pattern that looks like the following: (each byte value represents its index) 00010203 — XOR — 04050607 04050607 — XOR — 08090A0BMar 27, 2022 · Cobalt Strike "Beacon". I received an email today, stating that someone or group had installed something called Cobalt Strike Beacon on all of my devices, and if I didn't pay they were going to release the information that they had "downloaded" to their servers. The email says it's from *** Email address is removed for privacy *** Any ... Cobalt Strike will even tab complete your aliases for you. You should see Hello World! in the Beacon console. You may also use the &alias function to define an alias. Cobalt Strike passes the following arguments to an alias: $0 is the alias name and arguments without any parsing. $1 is the ID of the Beacon the alias was typed from.Cobalt Strike Beacon Parser. Knowing the obvious (the Powershell decoding method and shellcode very similar to Metasploits Meterpreter, and from working with previous samples). We know with a high degree of confidence the payload is a Cobalt Strike payload.SMB Beacon. Select Beacon SMB as the Payload type and give the listener a Name. Make sure to give the new listener a memorable name as this name is how you will refer to this listener through Cobalt Strike’s commands and workflows. The only option associated with the SMB Beacon is the Pipename (C2). You can set an explicit pipename or accept ...To Beacon, a BOF is just a block of position-independent code that receives pointers to some Beacon internal APIs. To Cobalt Strike, a BOF is an object file produced by a C compiler. Cobalt Strike parses this file and acts as a linker and loader for its contents. This approach allows you to write position-independent code, for use in Beacon ... Writing Beacon Object Files: Flexible, Stealthy, and Compatible. Monday 20 December, 2021. Our colleagues over at Core Security have been doing great things with Cobalt Strike, making use of it in their own engagements. They wrote up this post on creating Cobalt Strike Beacon Object Files using the MinGW compiler on Linux. The Cobalt Strike Beacon email scam uses real cybersecurity terms and threats of leaking videos to try extorting money through fear. But a closer look reveals sheer manipulation. Stay alert for emails demanding quick anonymous payment in bitcoin to keep fabricated videos private. Report them as phishing, but never respond or open attachments.The threat actor also installed Cobalt Strike PowerShell stagers on servers accessed when moving laterally through the compromised network. These stagers allowed the Cobalt Strike Beacon payload to execute in memory. Cobalt Strike PowerShell stager's default execution pattern is always configured to launch as a service and is …Short bio. Trojan is Malwarebytes’ detection name that applies to various types of malware that hide their true intentions and then exploit systems once they are inside.. Type and source of infection. Common infection methods for Trojans include:The Cobalt Strike Team Server, also known as CS Team Server, is the centralized C2 application for a Beacon and its operator (s). It accepts client connections, orchestrates remote commands to Beacon implants, provides … Redefine Beacon's communication with Cobalt Strike's malleable C2 language. This allows you to cloak Beacon activity to look like other malware or blend-in as legitimate traffic. The Beacon Console. Right-click on a Beacon session and select interact to open that Beacon’s console. The console is the main user interface for your Beacon session. A key part of Cobalt Strike is the Beacon, a piece of software injected into the target computer to create a secret communication channel that enables the Cobalt …Cobalt Strike has a client-server architecture, in which several users (e.g., the members of the red team performing the attack) connect to a Team Server using the Aggressor client application. ... One of the most important components of the Cobalt Strike framework is the Beacon component. This component is installed on a host as part of …The Cobalt Strike Team Server, also known as CS Team Server, is the centralized C2 application for a Beacon and its operator (s). It accepts client connections, orchestrates remote commands to Beacon implants, provides …Ryan Stephenson (RCStep) Adds Shellcode - Shellcode Generator to the Cobalt Strike top menu bar. CSSG is aggressor, .NET, and python scripts used to more easily generate and format beacon shellcode. Generates beacon stageless shellcode with exposed exit method, additional formatting, encryption, encoding, compression, multiline output, etc.When Beacon starts, it resolves metadata to send back to Cobalt Strike. Previously, Beacon stuck out like a sore thumb in mature environments since the method used to resolve this metadata triggered Sysmon event 22 (DNS Query) and had become a way to reliably fingerprint Beacon every time it runs. The 4.4 release modifies how this …The UDRL is an important aspect of Cobalt Strike’s evasion strategy. Cobalt Strike achieves “evasion through flexibility”, meaning we give you the tools you need to modify default behaviors and customize Beacon to your liking. This was something that Raphael Mudge felt strongly about and will remain a key part of the Cobalt Strike ...The Cobalt Strike team server has no remote attacks or built-in offensive capability [with the exception of spear phishing]. Instead, Cobalt Strike pushes all of its offensive actions down to the Beacon payload. The Beacon payload then executes these things on your behalf. This method of offense plays well with asynchronous communication.Cobalt Strike is a threat emulation tool which simulates adversarial post-exploitation scenarios and supports Red Team operations. Replicate the tactics of a long-term embedded threat actor using a post-exploitation agent, Beacon, and Malleable C2, a command and control program that enables modification of network indicators to blend in …BEACON is the name for Cobalt Strike’s default malware payload used to create a connection to the team server. Active callback sessions from a target are also …Parses beacon's configuration from beacon PE or memory dump. Returns json of config is found; else it returns None. :int version: Try a specific version (3 or 4), or leave None to try both of themJun 30, 2021 · Cobalt Strike [1] is a tool to support red teams in attack simulation exercises. To this end, Cobalt Strike provides several techniques that allow a red team to execute targeted attacks to compromise a target network, established a bridge head on a host, and then move laterally to gain additional access to computers, accounts, and, eventually, data. Cobalt Strike is highly configurable, but many actors use default settings, such as SSL certs, Beacon URLs, and profiles that offer defenders detection opportunities. Advanced threat actors will customize Cobalt Strike payloads to avoid detection better using built-in tools like Artifact Kit, Malleable C2 Profiles, and Resource Kit.Exploring Cobalt Strike’s Beacon instructions. All the evidence suggests that beacon.dll is the Cobalt Strike Beacon malware. To understand what this malware is capable of; we analysed the DLL further. At the core of beacon.dll is a large switch statement containing cases to handle the client-side execution of C2 commands, shown in Figure 9.A tool to hunt/mine for Cobalt Strike beacons and "reduce" their beacon configuration for later indexing. Hunts can either be expansive and internet wide using services like SecurityTrails, Shodan, or ZoomEye or a list of IP's. Getting started. Install melting-cobalt;Mar 10, 2023 · The Cobalt Strike C2 implant, known as Beacon, is a Windows Dynamic-Link Library (DLL), and the modular capability of using our own DLL loader in Cobalt Strike is known as the User-Defined ... Cobalt Strike là phần mềm dành cho việc khai thác và triển khai Beacon trên máy nạn nhân. Hiểu nôm na Beacon giống như một con sâu vậy, nó nằm im lặng trong máy nạn nhân, kết nối trực tiếp với internet, được …Jun 1, 2021 · Cobalt Strike Beacon provides encrypted communication with the C&C server to send information and receive commands. Those commands can include instructions to download malware. After doing this, they can use Cobalt Strike to map out the network and identify any vulnerabilities as well as deploy implants, backdoors, and other tools to accomplish ... When Beacon starts, it resolves metadata to send back to Cobalt Strike. Previously, Beacon stuck out like a sore thumb in mature environments since the method used to resolve this metadata triggered Sysmon event 22 (DNS Query) and had become a way to reliably fingerprint Beacon every time it runs. The 4.4 release modifies how this … Cobalt Strike will even tab complete your aliases for you. You should see Hello World! in the Beacon console. You may also use the &alias function to define an alias. Cobalt Strike passes the following arguments to an alias: $0 is the alias name and arguments without any parsing. $1 is the ID of the Beacon the alias was typed from. Cobalt Strike系列教程第一章：简介与安装. Cobalt Strike是一款超级好用的渗透测试工具，拥有多种协议主机上线方式，集成了提权，凭据导出，端口转发，socket代理，office …Cobalt Strike is ubiquitous in the cyber security arena. It’s a prolific toolkit used at many levels of intrusion to solve adversaries' problems like post-intrusion …SMB Beacon. Select Beacon SMB as the Payload type and give the listener a Name. Make sure to give the new listener a memorable name as this name is how you will refer to this listener through Cobalt Strike’s commands and workflows. The only option associated with the SMB Beacon is the Pipename (C2). You can set an explicit pipename or accept ...Oct 19, 2023 · The Cobalt Strike Beacon scam email utilizes various sophisticated social engineering and pressure tactics to manipulate and deceive victims. Here is how it operates, step-by-step: The email will have an alarming or urgent subject line designed specifically to entice opening and reading. May 16, 2019 · This is a detection for Cobalt Strike Beacon, which is a software component that gets deployed in target devices and allows an attacker remote access to the device to perform various tasks. Mar 9, 2023 · Cobalt Strike is a commercial threat emulation platform designed to provide long-term, covert command-and-control (C2) communication between Beacon agents and the attacker-controlled Team Server. A domain-specific language called Malleable C2 is exposed to Cobalt Strike operators which allows them to create highly flexible and evasive network ... The Cobalt Strike Arsenal Kit is a collection of customizable tools that enable users to better simulate real-world adversary tactics and techniques. Users can build and use the kits as they are or modify them to suit their engagements and support their goals. The Arsenal Kit includes: The Sleep Mask Kit – Hides Beacon in memory while it sleeps. Threat Spotlight Cobalt Strike. Cisco Talos discovered a malicious campaign in August 2022 delivering Cobalt Strike beacons that could be used in later, follow-on attacks. Lure themes in the phishing documents in this campaign are related to the job details of a government organization in the United States and a trade union in …To Beacon, a BOF is just a block of position-independent code that receives pointers to some Beacon internal APIs. To Cobalt Strike, a BOF is an object file produced by a C compiler. Cobalt Strike parses this file and acts as a linker and loader for its contents. This approach allows you to write position-independent code, for use in Beacon ...Cobalt Strike allows users to obfuscate Beacon via its malleable C2 profile. For example, the stage{} block can be used to modify the RAW Beacon payload and define how it is loaded into memory. Whilst this offers flexibility, it does have limitations which can expose Beacon to detection via YARA scanning (as shown in the Cobalt Strike and …Cobalt Strike does not provide a way to override the default macro attack. Fortunately, its choice of rundll32.exe is a string inside of the macro that you can edit. If this choice does not work for you, change this to another process. Many times, I have edited Cobalt Strike’s VBA macro to spawn Internet Explorer and inject my stager into it.Monday 20 December, 2021. The User Defined Reflective Loader (UDRL) was first introduced in Cobalt Strike 4.4. to allow the creation and use of a custom reflective loader. This quickly took off by the community and its limits were pushed. Updates were made in 4.5 to help address some of these limits.Cobalt Strike is ubiquitous in the cyber security arena. It’s a prolific toolkit used at many levels of intrusion to solve adversaries' problems like post-intrusion …These beacons send data back with an HTTP POST request. This is the default. You have incredible control over the behavior and indicators in this payload via Malleable C2. HTTP(S) Listener Setup. To create a HTTP or HTTPS Beacon listener select Cobalt Strike-> Listeners on the main menu and press the Add button at the bottom of the …The Cobalt Strike beacon is highly malleable and as such some indicators may vary depending on the malleable profile options selected. Cobalt Strike In Memory. Hunting for Cobalt Strike signatures in memory has been fruitful for threat hunters in the past, with prior comprehensive write ups being provided by Elastic. However, since then much ...The Cobalt Strike Configuration Extractor (CSCE) by Stroz Friedberg is a "python library and set of scripts to extract and parse configurations from Cobalt Strike beacons". To use the CSCE, we'll create a Python virtual environment, activate it, and install the CSCE Python package. Setting up the Cobalt Strike Configuration ExtractorBOF.NET contains a small native BOF that acts as a bridge into the managed world. When bofnet_init is called, this will start the managed CLR runtime within the process that beacon is running from. Once the CLR is started, a separate .NET AppDomain is created to host all assemblies loaded by BOF.NET.The first release of Beacon served as a light-weight remote administration tool. Something you could use to spawn a session or execute commands on a compromised system. Now, Beacon is turning into a tool for silently collecting information on your behalf. Today’s Cobalt Strike update adds a keystroke logger to Beacon.We would like to show you a description here but the site won’t allow us.Cobalt Strike is commercial threat emulation software that emulates a quiet, long-term embedded actor in a network. This actor, known as Beacon, communicates …This repository is meant to host the core files needed to create a Beacon Object File for use with Cobalt Strike. A Beacon Object File (BOF) is a compiled C program, written to a convention that allows it to execute within a Beacon process and use internal Beacon APIs. BOFs are a way to rapidly extend the Beacon agent with new post-exploitation ...These beacons send data back with an HTTP POST request. This is the default. You have incredible control over the behavior and indicators in this payload via Malleable C2. HTTP(S) Listener Setup. To create a HTTP or HTTPS Beacon listener select Cobalt Strike-> Listeners on the main menu and press the Add button at the bottom of the … Writing Beacon Object Files: Flexible, Stealthy, and Compatible. Monday 20 December, 2021. Our colleagues over at Core Security have been doing great things with Cobalt Strike, making use of it in their own engagements. They wrote up this post on creating Cobalt Strike Beacon Object Files using the MinGW compiler on Linux. The first release of Beacon served as a light-weight remote administration tool. Something you could use to spawn a session or execute commands on a compromised system. Now, Beacon is turning into a tool for silently collecting information on your behalf. Today’s Cobalt Strike update adds a keystroke logger to Beacon.The Sleep Mask Kit was first introduced in Cobalt Strike 4.4 to allow users to modify how the sleep mask function looks in memory in order to defeat static signatures that identified Beacon. This quickly took off in the community and its limits were pushed. Updates were made in 4.5 to help address some of these limits.. Licensed users can …This post, from Ernesto Alvarez Capandeguy of Core Security’s CoreLabs Research Team, describes techniques used for creating UDP redirectors for protecting Cobalt Strike team servers. This is one of the recommended mechanisms for hiding Cobalt Strike team servers and involves adding different points which a Beacon can contact for …Signaturing Cobalt Strike. Cobalt Strike is a popular framework for conducting red team operations and adversary simulation. Presumably due to its ease of use, stability, and stealth features, it is also a favorite tool for bad actors with even more nefarious intentions. There have been various techniques for detecting Beacon, Cobalt …Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as "adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors". Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.Cobalt Strike allows users to obfuscate Beacon via its malleable C2 profile. For example, the stage{} block can be used to modify the RAW Beacon payload and define how it is loaded into memory. Whilst this offers flexibility, it does have limitations which can expose Beacon to detection via YARA scanning (as shown in the Cobalt Strike and …The goal for any Cobalt Strike attack is the deployment of a post-exploitation payload, known as a “Beacon,'' onto a compromised endpoint. While some Cobalt Strike attacks can involve executables such as DLL files or libraries being installed on a targeted endpoint, most work by injecting malicious shellcode into legitimate processes.
Jan 12, 2023 · Virus check your devices using Norton Power Eraser if applicable or any of the antivirus checks that Norton supply for mobile devices. Do search for topics such as Cobalt Strike "Beacon". When I did this I saw a response by a Microsoft independent advisor who advised steps such as scanning devices and reporting the originator of the message. . Penneymac
"For example, Cobalt Strike often creates instances of "rundll32.exe" without any command line parameters during process injection, which is an unusual activity. Named pipes are also used for communication between the beacon and spawned processes, where defenders can use Sysmon to detect Cobalt Strike named pipes." Follow The …Mar 27, 2022 · Cobalt Strike "Beacon". I received an email today, stating that someone or group had installed something called Cobalt Strike Beacon on all of my devices, and if I didn't pay they were going to release the information that they had "downloaded" to their servers. The email says it's from *** Email address is removed for privacy *** Any ... SMB Beacon. Select Beacon SMB as the Payload type and give the listener a Name. Make sure to give the new listener a memorable name as this name is how you will refer to this listener through Cobalt Strike’s commands and workflows. The only option associated with the SMB Beacon is the Pipename (C2). You can set an explicit pipename or accept ...geacon_pro supports Windows, Linux and Mac. For the basic usage, please refer to the original project geacon. Adding -ldflags "-H windowsgui -s -w" when compiling binary can reduce the program size and hide the cmd window. When compiling for linux and mac, adding -ldflags "-s -w" can reduce the size of the program, and then run it in the …The threat actor also installed Cobalt Strike PowerShell stagers on servers accessed when moving laterally through the compromised network. These stagers allowed the Cobalt Strike Beacon payload to execute in memory. Cobalt Strike PowerShell stager's default execution pattern is always configured to launch as a service and is …A tool to hunt/mine for Cobalt Strike beacons and "reduce" their beacon configuration for later indexing. Hunts can either be expansive and internet wide using services like SecurityTrails, Shodan, or ZoomEye or a list of IP's. Getting started. Install melting-cobalt;We would like to show you a description here but the site won’t allow us.From Beacon to Interactive RDP Session. Lateral Movement, Tunnelling, Firewall Evasion. This is a quick note showing how to get an interactive Remote Desktop Session (RDP) session from a Cobalt Strike beacon by leveraging socks proxy and proxychains.Learn how to identify and detect adversary activities using Cobalt Strike's Beacon client agent, a tool for post-exploitation and red team operations. The blog explains the behavior, commands, and …Beacon; Interoperablity; Community. All Features > Footer Menu 2. Interoperability. Core Impact; Outflank Security Tooling; Footer Menu 3. Support. Training; Community Kit; ... Cobalt Strike support resources, including the Cobalt Strike Manual, Community Kit, and Technical notes are available to help users. The DNS Beacon is a favorite Cobalt Strike feature. This payload uses DNS requests to beacon back to you. These DNS requests are lookups against domains that your Cobalt Strike team server is authoritative for. The DNS response tells Beacon to go to sleep or to connect to you to download tasks. The DNS response will also tell the Beacon how to ... The HTTP and HTTPS beacons download tasks with an HTTP GET request. These beacons send data back with an HTTP POST request.https://www.cobaltstrike.com/help-...Nov 18, 2020 · Cobalt Strike, though, hides shellcode over a named pipe. ... The Malleable C2 module in Cobalt Strike is an advanced tool that allows attackers to customize beacon traffic and create covert ... Beacon is Cobalt Strike’s payload to model advanced attackers. Use Beacon to egress a network over HTTP, HTTPS, or DNS. You may also limit which hosts egress a network by controlling peer- to-peer Beacons over Windows named pipes and TCP sockets. Beacon is flexible and supports asynchronous and interactive communication.This report provides detailed analysis of three malicious ISO files associated with a spearphishing campaign using Constant Contact. The files contain a custom …Port 4444 is the default port for Metasploit, another hacking platform which is often seen in conjunction with Cobalt Strike beacon. It then presented the human analysts with a full list of compromised hosts. Figure 3: Cyber AI Analyst summary of an affected host using non-standard ports for C2 and subsequently scanning the network.Cobalt Strike 3.2, the third release in the 3.x series, is now available. The 3.2 release focuses on fixes and improvements across the Cobalt Strike product. x64 Beacon Cobalt Strike’s x86 Beacon plays pretty well in an x64 world. You can inject the keystroke logger and screenshot tools into 64-bit processes..