I made a small PoC. cs-mitm. py is a mitmproxy script that intercepts Cobalt Strike traffic, decrypts it and injects its own commands. In this video, a malicious beacon is terminated by sending it an exit command. I selected a malicious beacon that uses one of the leaked private keys.
The script does not support data transforms, but that can be easily added, for example with code found in cs-parse-traffic.py.
Didier Stevens 
[…] Didier StevensMiTM Cobalt Strike Network Traffic […]
Pingback by Week 50 – 2021 – This Week In 4n6 — Sunday 12 December 2021 @ 11:27