v1.3.0

This v1.3.0 release brings support for Cobalt Strike 4.11 to 4.13, it can now unwrap beacons by the new stage.transform-obfuscate feature introduced in Cobalt Strike 4.11.

Beacons wrapped in multiple layers of obfuscation are now detected and transparently unwrapped with any combination of base64, xor, rc4 and lznt1. The BeaconConfig.from_*() constructors unwrap these layers automatically, and the recovered chain is exposed via the new .stages and .obfuscate_settings attributes:

>>> from dissect.cobaltstrike.beacon import BeaconConfig
>>> bconfig = BeaconConfig.from_path("beacon_obfuscated.bin")
>>> bconfig.version
<BeaconVersion 'Cobalt Strike 4.12 (Nov 24, 2025)', tuple=(4, 12), date=2025-11-24>
>>> bconfig.stages
['ObfuscatedBeacon(OBFUSCATION_BASE64)',
 'ObfuscatedBeacon(OBFUSCATION_XOR)',
 'ObfuscatedBeacon(OBFUSCATION_RC4)',
 'ObfuscatedBeacon(OBFUSCATION_LZNT1)',
 'ObfuscatedBeacon(OBFUSCATION_NONE)']
>>> bconfig.obfuscate_settings
[<StageObfuscateSettings obfuscation_type=<ObfuscationType.OBFUSCATION_BASE64: 3> key_size=0x0 original_size=0x33417 payload_size=0x44574>,
 <StageObfuscateSettings obfuscation_type=<ObfuscationType.OBFUSCATION_XOR: 1> key_size=0x40 original_size=0x333c7 payload_size=0x333c7>,
 <StageObfuscateSettings obfuscation_type=<ObfuscationType.OBFUSCATION_RC4: 2> key_size=0x80 original_size=0x33337 payload_size=0x33337>,
 <StageObfuscateSettings obfuscation_type=<ObfuscationType.OBFUSCATION_LZNT1: 4> key_size=0x0 original_size=0x44c10 payload_size=0x33327>,
 <StageObfuscateSettings obfuscation_type=<ObfuscationType.OBFUSCATION_NONE: 0> key_size=0x0 original_size=0x44c00 payload_size=0x44c00>]

The beacon config scanner is now also more resilient by locating the config by the RSA key embedded in SETTING_PUBKEY, so it holds up against tampered setting index/type values. A new normalization pipeline adapts modified configs so they still parse.

New beacon-dump options: --fail-on-error and recursive directory input.

We also now depend on the following extra core dependencies:

• pycryptodome for RC4
• dissect.executable for PE parsing
• dissect.util for RangeStream, lznt1 decompression and other useful utilities

Python 3.9 support has been dropped.

What's Changed

• Add additional version stamp for Cobalt Strike 4.10 by @yunzheng in #80
• Cstruct changes by @twiggler in #81
• Update project dependencies and drop support for Python 3.9 by @yunzheng in #82
• Add support for Cobalt Strike 4.11 transform-obfuscate and newer versions by @yunzheng in #83
• Add CHANGELOG and ignore uv.lock and docs build artifacts by @yunzheng in #84

New Contributors

• @twiggler made their first contribution in #81

Full Changelog: v1.2.1...v1.3.0