What is Beacon?

Beacon is Cobalt Strike's remote administration payload for long-term engagements. Beacon does not provide real-time control of a compromised host. Beacon is asynchronous. It spends most of its time sleeping. Occasionally, Beacon will contact Cobalt Strike to check for tasks.

If a tasking is available, Beacon will download its tasks and execute them. This style of command and control is common with sophisticated malware and Advanced Persistent Threat actors.

Cobalt Strike's Beacon payload may attempt to communicate through multiple domains. This makes your control of a compromised host more robust. If a system administrator blocks one IP address or domain, Beacon may still receive tasks through its other domains.

When tasks are available, Beacon downloads them and sends output using the HTTP protocol. Beacon may check for tasks through HTTP or DNS requests.

[ What is Beacon? | Beacon Setup | Beacon Delivery | Beacon Manager | Beacon Console ]