This is an update of my tool to analyze Cobalt Strike beacons.
Option -l can be used to generate YARA rules to search for Cobalt Strike beacons with a given license ID.
1768_v0_0_4.zip (https)
MD5: 35779393F2DC6171731446F8E0AC361B
SHA256: 59148C2DA13BE4DB203F9444E837911476BDE74E41E5A82C865E9729101336D2
Article Link: https://blog.didierstevens.com/2020/12/27/update-1768-py-version-0-0-4/