BULK ANALYSIS OF COBALT STRIKE'S BEACON CONFIGURATIONS

Summary from the TLDR InfoSec newsletter

This post shares a dataset of Cobalt Strike Beacon payloads and their extracted configurations going back to November 2021. Analysis of the dataset shows that 88.97% of payloads leverage the CreateThread API call for process injection. Nearly 62.81% of the samples in the dataset have the default sleep time of 60,000 milliseconds.