CobaltStrikeScan

Focuses specifically on Cobalt Strike beacons using high-quality YARA signatures from community research like Neo23x0's Signature Base, ensuring accurate identification of v3 and v4 beacons.

Parses and displays the beacon's configuration when detected, providing key threat intelligence such as C2 servers and campaign IDs, as highlighted in the acknowledgments for forensic analysis.

Compiles into a static exe with dependencies embedded via Costura.Fody, making it easy to run on Windows systems without additional installations, as noted in the building instructions.

Supports scanning running processes, individual files, or entire directories for flexibility, with options like --scan-processes and --directory-scan for varied forensic scenarios.