The Beacon Console

Right-click on a Beacon session and select interact to open that Beacon’s console. The console is the main user interface for your Beacon session. The Beacon console allows you to see which tasks were issued to a Beacon and to see when it downloads them. The Beacon console is also where command output and other information will appear

In between the Beacon console’s input and output is a status bar. This status bar contains information about the current session. In its default configuration, the statusbar shows the target’s NetBIOS name, the username and PID of the current session, and the Beacon’s last check-in time.

Each command that’s issued to a Beacon, whether through the GUI or the console, will show up in this window. If a teammate issues a command, Cobalt Strike will pre-fix the command with their handle.

You will likely spend most of your time with Cobalt Strike in the Beacon console. It’s worth your time to become familiar with its commands. Type help in the Beacon console to see available commands. Type help followed by a command name to get detailed help.

The Beacon Menu

Right-click on a Beacon or inside of a Beacon’s console to access the Beacon menu. This is the same menu used to open the Beacon console. The following items are available:

1) Access: The Access menu contains options to manipulate trust material and elevate your access.

2) Explore: The Explore menu consists of options to extract information and interact with the target’s system.

3) Pivoting: The Pivoting menu is where you can setup tools to tunnel traffic through a Beacon.

4) Session: The Session menu is where you manage the current Beacon session.

Some of Cobalt Strike’s visualizations (the pivot graph and sessions table) let you select multiple Beacons at one time. Most actions that happen through this menu will apply to all selected Beacon sessions.