How does this work?
Primarily, using Cobalt Strike’s
breg_queryv functions. Then, all beacon output is hijacked with
beacon_output, looking for specific values. When a positive match is made, the output will be highlighted in the beacon output. Since there is no
beacon_output_reg or something similar, like
beacon_output_ps, all output must be captured for parsing.
What if my AV/EDR product isn’t detected? / How can I help?
This is expected. We couldn’t test for every AV/EDR solution, and we knew that many would be missing. You can help us out by submitting a GitHub issue including the following info:
- If this is a System/AV/EDR entry
- The name of the product
- Relevant registry entries that can be used to positively ID the product
If you like the site, please consider joining the telegram channel or supporting us on Patreon using the button below.