# Parse Cobalt Strike Beacon Configuration
> Extract C2 config from a Cobalt Strike beacon or shellcode

**Tools:** [[tools/1768-py|1768-py]], [[tools/yara|yara]]
**FOR610 Lab:** 3.4

## Commands
```bash
# Scan with YARA for CS signatures
yara-rules <sample>
# Extract beacon configuration
1768.py <sample_or_shellcode.bin>
```

#recipe #1768-py #yara