MDSec on detecting in-memory beacons and Cobalt Strike

MDSec performed an analysis of beacon frameworks. In the first article they outlined a number of strategies for detecting in-memory beacons, from suspicious DLL load sequences and patched functions such as AmsiScanBuffer to threads starting from unbacked memory. In the second article they discuss strategies to detect the popular C2 framework Cobalt Strike, including its Sleep Mask Kit, module stomping and fingerprinting the team server through quirks of its NanoHttpd web server. Elastic had already shown in 2021 that YARA rules can match Beacon in memory even while it sleeps behind its own obfuscation. Apparently beacons talk in their sleep.