Add Cobalt Strike 4.7 settings and version info (#19)

fox-it · Sep 13, 2022 · de1e10f · de1e10f
1 parent a753353
commit de1e10f
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/dissect/cobaltstrike/beacon.py b/dissect/cobaltstrike/beacon.py
@@ -133,9 +133,13 @@
  SETTING_MAX_RETRY_STRATEGY_ATTEMPTS = 71,
  SETTING_MAX_RETRY_STRATEGY_INCREASE = 72,
  SETTING_MAX_RETRY_STRATEGY_DURATION = 73,
+
+ // CobaltStrike version >= 4.7 (Aug 17, 2022)
+ SETTING_MASKED_WATERMARK = 74,
 };
 
 enum DeprecatedBeaconSetting: uint16 {
+ SETTING_KILLDATE_YEAR = 16,
  SETTING_INJECT_OPTIONS = 36,
 };
 
@@ -579,6 +583,7 @@ def null_terminated_str(data: bytes) -> str:
  BeaconSetting.SETTING_DNSRESOLVER: null_terminated_str,
  BeaconSetting.SETTING_DNS_IDLE: lambda x: str(ipaddress.IPv4Address(x)),
  BeaconSetting.SETTING_WATERMARKHASH: lambda x: null_terminated_bytes(x) if isinstance(x, bytes) else x,
+ BeaconSetting.SETTING_MASKED_WATERMARK: lambda x: x.hex()
  # BeaconSetting.SETTING_PROTOCOL: lambda x: BeaconProtocol(x).name,
  # BeaconSetting.SETTING_CRYPTO_SCHEME: lambda x: CryptoScheme(x).name,
  # BeaconSetting.SETTING_PROXY_BEHAVIOR: lambda x: ProxyServer(x).name,

diff --git a/dissect/cobaltstrike/version.py b/dissect/cobaltstrike/version.py
@@ -30,6 +30,7 @@
  59: "Cobalt Strike 4.2 (Nov 06, 2020)",
  70: "Cobalt Strike 4.3 (Mar 03, 2021)",
  73: "Cobalt Strike 4.5 (Dec 14, 2021)",
+ 74: "Cobalt Strike 4.7 (Aug 17, 2022)",
 }
 """ Max setting enum to Cobalt Strike version mapping """
 
@@ -66,6 +67,7 @@
  0x6255EB4E: "Cobalt Strike 4.6 (Apr 12, 2022)",
  0x6255EB6E: "Cobalt Strike 4.6 (Apr 12, 2022)",
  0x6255EB91: "Cobalt Strike 4.6 (Apr 12, 2022)",
+ 0x62EBF2B8: "Cobalt Strike 4.7 (Aug 17, 2022)",
 }
 """ PE export timestamp to Cobalt Strike version mapping """