Cobalt Strike Walkthrough

#!/bin/bash
LOG_DIR="${1:-/opt/zeek/logs/current}"
SUSPECT="10.0.1.75"
CS_JA3="51c64c77e60f3980eea90869b68c58a8"

echo "=== 1. Find C2 endpoint (JA3 fingerprint match) ==="
awk 'NR>8 && !/^#/' "$LOG_DIR/ssl.log" | \
  awk -v ja3="$CS_JA3" -F'\t' "$(awk 'BEGIN{
    print \"NR>8 && !/^#/ && \$0 ~ ja3 {print \$3, \$5, \$6, \$8, \$9}\"
  }')" 2>/dev/null || \
  grep "$CS_JA3" "$LOG_DIR/ssl.log" | \
  awk -F'\t' '{print $1"\t"$3"\t"$5"\t"$8}' | head -5

echo ""
echo "=== 2. Beacon timing analysis ==="
awk 'NR>8 && !/^#/' "$LOG_DIR/conn.log" | \
  awk -v src="$SUSPECT" -F'\t' '$3==src {print $1"\t"$5"\t"$6}' | \
  grep "185\." | python3 -c "
import sys, math
from collections import defaultdict
flows = defaultdict(list)
for line in sys.stdin:
    parts = line.strip().split('\t')
    if len(parts) >= 3:
        try:
            flows[(parts[1], parts[2])].append(float(parts[0]))
        except: pass

for (dst, port), ts in flows.items():
    ts.sort()
    ivs = [ts[i+1]-ts[i] for i in range(len(ts)-1) if 5 < ts[i+1]-ts[i] < 3600]
    if len(ivs) < 3: continue
    mean = sum(ivs)/len(ivs)
    cv = math.sqrt(sum((x-mean)**2 for x in ivs)/len(ivs))/mean if mean > 0 else 999
    print(f'BEACON dst={dst}:{port} n={len(ts)+1} interval={mean:.0f}s cv={cv:.3f}')
"

echo ""
echo "=== 3. Lateral movement via SMB ==="
awk 'NR>8 && !/^#/' "$LOG_DIR/conn.log" | \
  awk -v src="$SUSPECT" -F'\t' '$3==src && $6=="445" {print $5}' | \
  sort -u | head -20

echo ""
echo "=== 4. Kerberoasting (TGS requests) ==="
awk 'NR>8 && !/^#/' "$LOG_DIR/kerberos.log" 2>/dev/null | \
  awk -v src="$SUSPECT" -F'\t' '$3==src && $7=="TGS" {print $1"\t"$5"\t"$6}' | head -20

echo ""
echo "=== 5. Check compromised hosts for secondary beacons ==="
PIVOTS="10.0.1.10 10.0.1.20 10.0.1.30"
for host in $PIVOTS; do
    count=$(grep "$CS_JA3" "$LOG_DIR/ssl.log" 2>/dev/null | grep -c "$host")
    if [ "$count" -gt 0 ]; then
        echo "  SECONDARY BEACON on $host: $count TLS connections with CS JA3"
    fi
done

echo ""
echo "=== 6. Scope summary ==="
echo "Initial compromise: $SUSPECT"
echo "C2 JA3: $CS_JA3"
echo "Lateral movement targets: check SMB connections above"
echo "Kerberoasting: check TGS-REQ count above"
echo "Action: Isolate all affected hosts, collect PCAP for forensic evidence"