White Knight Labs walked through how far a tuned Malleable C2 profile gets a Cobalt Strike 4.8 beacon: sleep_mask, obfuscate, strrep and prepend in transform-x64, a four-character magic_mz_x64, a custom magic_pe, and a post-ex block that turns amsi_disable and threadhint off (both memory IOCs) and spawns into wmiprvse.exe.
After checks with ThreatCheck, Elastic’s YARA rules (one needed a byte patch), BeaconEye and Hunt-Sleeping-Beacons, the tuned profile with a custom magic_pe got a beacon past a fully updated Sophos EDR without encrypting the shellcode.
The Sleep Mask Kit is there for a reason: Elastic’s Joe Desimone showed in 2021 that the built-in sleep mask only hides strings and data, so a YARA rule on the deobfuscation routine itself still catches a sleeping beacon.
The companion repository holds the profiles and small Python helpers that generate junk prepend bytes and a Rich header, plus one that patches the bytes Elastic’s f0b627fc rule matches.
Running the default profile is basically wearing a name tag that says “beacon”.
