DOCSEARCHbyAlgolia
Submit Docs

BeaconEye Documentation

repository·master·Indexed 21 days ago

https://github.com/ccob/beaconeye

A CobaltStrike beacon hunting and command monitoring tool that identifies active beacons in live processes or MiniDump files. It supports dumping beacon configurations and decrypting C2 traffic for HTTP/HTTPS beacons, including the ability to decode AES keys from malleable profiles.

Tokens
1K
Snippets
2
Records
4
Agent score
26%

What's inside BeaconEye

  1. Overview of BeaconEye

    master

    BeaconEye is a tool designed to scan running processes or MiniDump files for active CobaltStrike beacons. Once a beacon is identified, BeaconEye can optionally monitor the process for C2 (Command and Control) activity. It supports decoding AES keys from malleable profiles on the fly, allowing it to extract and decrypt beacon output when commands are issued by an operator.

    Key Capabilities:

    • Detects standalone and injected beacons.
    • Detects beacons using the built-in sleep_mask.
    • Scans both live processes and offline MiniDump files (*.dmp or *.mdmp).
    • Dumps beacon configurations.
    • Displays output from most beacon commands and saves screenshots.
    • Creates a dedicated log folder for each detected process in the current working directory.

  2. Understand BeaconEye limitations and caveats

    master

    As of version 0.3 (Alpha), users should be aware of the following limitations:

    • Monitoring Scope: While BeaconEye can detect all beacon types, it can only monitor HTTP/HTTPS beacons. Support for named pipe and TCP beacons is currently in the TODO list.
    • Decryption Scope: Currently, only command output is decoded; command requests are not yet supported.
    • Detection Accuracy: Because the tool is in Alpha, some 4.x beacons may not be detected, or malleable C2 profiles might not be parsed correctly, leading to incorrect output decoding.
    • Logging: Log folders are created relative to the current directory where the tool is executed.

  3. Reference the BeaconEye CLI flags

    master

    The following command-line arguments are available for BeaconEye:

    FlagLong FlagDescription
    -v--verboseDisplay more verbose output instead of just information on beacons found
    -m--monitorAttach to and monitor beacons found when scanning live processes
    -f--filter=VALUEFilter process list with names starting with VALUE (live mode only)
    -d--dump=VALUEA folder to use for MiniDump mode to scan for beacons (files with *.dmp or *.mdmp)
    -h--helpDisplay this help
    BeconEye by @_EthicalChaos_
  CobaltStrike beacon hunter and command monitoring tool x86_64

  -v, --verbose              Display more verbose output instead of just
                               information on beacons found
  -m, --monitor              Attach to and monitor beacons found when scanning
                               live processes
  -f, --filter=VALUE         Filter process list with names starting with x (
                               live mode only)
  -d, --dump=VALUE           A folder to use for MiniDump mode to scan for
                               beacons (files with *.dmp or *.mdmp)
  -h, --help                 Display this help

  4. Use the BeaconEye CLI

    master

    BeaconEye is a command-line tool. You can use it to scan live processes, filter process lists, or scan offline MiniDump files. To monitor C2 activity (HTTP/HTTPS) for beacons found in live processes, use the --monitor flag.

    # Example: Scan live processes and monitor HTTP/HTTPS beacons
BeconEye -m

# Example: Scan MiniDump files in a specific folder
BeconEye -d /path/to/dumps

# Example: Scan live processes and filter by name prefix
BeconEye -f myprocess