search

Apr4h / CobaltStrikeScan

Scan files or process memory for CobaltStrike beacons and parse their configuration
MIT License
893 stars 114 forks source link

feature: Specify PID #15

Open Still34 opened 2 years ago

Still34 commented 2 years ago

Describe the solution you'd like It appears the current method of scanning can take a little bit of time to scan through the entire system. It would be much more ideal if one could specify a suspected target process via a --pid argument (e.g. ./CobaltStrikeScan -i --pid 1234, much like malunpack or hollowshunter.

DamonMohammadbagher commented 1 year ago

C# code changed by me here you can download this:

CobaltStrikeScan.exe -t TargetPID

example: CobaltStrikeScan.exe -t 1234

link => https://github.com/DamonMohammadbagher/ETWProcessMon2/tree/main/ETWPM2Monitor2/ETWPM2Monitor2/bin/Debug