Guide · Agent skill
How to use the Cobalt Strike Malleable C2 Analyzer agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This is an agent skill that teaches an AI agent to read Cobalt Strike Malleable C2 profiles, the configuration scripts that tell a Beacon implant how to disguise its command-and-control traffic as ordinary web services. It is written for defenders, SOC analysts and researchers who have a captured profile or Beacon traffic to examine. After following this guide you will know how to install the skill, ask for an analysis in plain language, and what the output should contain.
Cobalt Strike Malleable C2 Analyzermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 2Install the Python libraries. Make sure you have Python 3.9 or later, then run pip install dissect.cobaltstrike and, if you want the alternative parser, pip install pyMalleableC2.
- 3Prepare your sample files. Place the malleable C2 profile or captured Beacon payload you want to examine in a working folder. Use copies, not originals.
- 4Ask for the analysis. Describe the task in plain language, naming the file and the output you want, such as URIs, headers, sleep and jitter, and injection settings.
- 5Review and test the output. Check the JSON report and any generated Suricata or Snort rules, then validate the rules against PCAPs before you deploy them.
What does the skill make the agent do?
The skill parses a Malleable C2 profile and extracts the settings that matter for network detection: HTTP and DNS transforms, URIs, headers, user agents, sleep and jitter timing, and process injection behaviour. It uses the dissect.cobaltstrike library for profiles and beacon-payload configurations, and pyMalleableC2 for AST-based parsing.
From those values the agent can produce a structured report with IOCs and suggested Suricata-compatible detection rules. The source describes the expected output as a JSON report containing C2 URIs, headers, user agents, sleep/jitter settings, injection config, spawned process paths, DNS settings and generated rules.
- Extracts URIs, HTTP headers and user agents from the GET and POST blocks
- Reads sleep time, jitter percentage and DNS beacon settings
- Reviews spawn-to and allocation settings for process injection
- Generates network signatures from the indicators it finds
How do you install the Cobalt Strike Malleable C2 Analyzer skill?
Download the skill ZIP from this page and unzip it into either your personal skills folder, ~/.claude/skills/, or a project folder at .claude/skills/ inside the project. Claude Code loads skills from these locations, so the skill folder should contain SKILL.md at its top level.
If you use the Claude apps instead, open Settings → Capabilities → Skills and upload the skill there.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills
Which Python libraries and tools do you need?
The skill needs Python 3.9 or later. The dissect.cobaltstrike library is optional and is used when available. The pyMalleableC2 library is optional and is referenced in the instructions as an alternative parser. Install whichever you need with pip.
Suricata or Snort is optional and only needed if you plan to deploy the generated signatures. You also need your own sample malleable C2 profile files, because the skill works on files you supply.
- Python 3.9+
- dissect.cobaltstrike (optional, used when available)
- pyMalleableC2 (optional, referenced in instructions)
- Suricata or Snort (optional, for deploying signatures)
- Sample malleable C2 profile files supplied by you
pip install dissect.cobaltstrike
pip install pyMalleableC2How do you trigger the skill with a natural request?
You do not need special syntax. Describe the task in plain language and mention the profile or traffic you have. The skill's description says to use it when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic, so requests along those lines should match.
Include the file path of the profile and say what you want back, such as a report or detection rules. If you have a Beacon payload rather than a profile, say so, because the library can also read beacon-payload configurations.
- Analyze the malleable C2 profile at ./samples/unknown.profile and list the URIs, user agents and sleep/jitter values.
- I captured a Beacon payload in this folder. Pull the configuration and tell me which process injection settings it uses.
- Write Suricata rules that would flag the HTTP GET and POST transforms in this profile, then list the indicators you used.
- Compare this profile against the known threat actor profiles you have and point out what matches.
What does a basic analysis look like in code?
The skill's API reference shows how the libraries load a profile and read its settings. The agent typically runs code like this when it analyses a file. You can run the same calls yourself to check its work.
The profile is loaded with C2Profile.from_path, converted to a dictionary with as_dict, and then individual keys are read. Beacon payloads are loaded with BeaconConfig.from_path.
from dissect.cobaltstrike.c2profile import C2Profile
profile = C2Profile.from_path("amazon.profile")
config = profile.as_dict()
print(config["useragent"])
print(config["http-get.uri"])
print(config["sleeptime"])What are the safety notes for running the skill?
The skill runs scripts, so review scripts/agent.py before you rely on it in sensitive environments. The skill's listing states that it does not use the network. Run it on copies of profiles and samples rather than on live systems.
The skill is framed for defensive analysis. Its listed capabilities are understanding profiles and producing detections. It is not presented as a tool for operating command-and-control infrastructure.
- Scripts run locally: review scripts/agent.py first
- The skill does not use the network, according to its listing
- Work on copies of sample files
- Treat generated signatures as drafts until tested
What tips help you get reliable results?
Always test generated signatures against PCAPs before you deploy them. The skill's own guidance says Suricata or Snort rules should be validated against captured traffic. The skill also mentions PCAP analysis tools for traffic validation.
The API reference notes an optional PCAP extra for dissect.cobaltstrike, which is useful when you want to extract beacons from captured traffic. Keep the profile and the traffic it came from together so you can check each detection against its source.
- Install the optional PCAP support with pip install 'dissect.cobaltstrike[full]' if you need it
- Check each generated rule against the PCAP it was based on
- Compare findings with the threat actor profile collections you trust
- Ask for the JSON report so you can review each field
What people use it for
- A SOC analyst extracts URIs, headers and user agents from a captured profile to understand how the traffic was disguised.
- A threat hunter drafts Suricata rules for the HTTP GET and POST transforms found in a suspicious profile.
- A researcher compares the sleep, jitter and DNS settings of a profile against a collection of known profiles.
- An analyst reviews the process injection and spawn-to settings in a Beacon payload configuration.
Frequently asked questions
How do I install the Cobalt Strike Malleable C2 Analyzer skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.
What do I need to run it?
You need Python 3.9 or later, the dissect.cobaltstrike and/or pyMalleableC2 libraries, and your own sample malleable C2 profile files. Suricata or Snort is optional and only needed to deploy the generated signatures.
Is the Cobalt Strike Malleable C2 Analyzer skill free to use?
The skill is licensed under Apache-2.0, as stated on its listing. Check the license file in the skill folder for the full terms.
What is the difference between dissect.cobaltstrike and pyMalleableC2?
According to the skill, dissect.cobaltstrike parses profiles and extracts configurations from beacon payloads, while pyMalleableC2 provides AST-based parsing for programmatic profile manipulation and validation. The skill lists pyMalleableC2 as an alternative parser.
Can it analyse Beacon traffic in a PCAP file?
The API reference shows a beacon-pcap command with an --extract-beacons option for pulling beacons from a PCAP, and says a full install of dissect.cobaltstrike adds PCAP support. Check the reference for the decryption options before relying on them.
Do I need to test the generated detection rules before using them?
Yes. The skill's listing says generated signatures still need testing against PCAPs before deployment, so validate them against captured traffic first.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits SOC analysts, threat hunters and security researchers who want an agent to read captured Cobalt Strike malleable profiles and draft network detections. It is less suitable for non-security users, since the output assumes familiarity with HTTP, Beacon behaviour and IDS rules, and for anyone who needs a verified detection product without their own PCAP testing.
Download the skill