reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/extracting-cobalt-strike-beacon-config/references/api-reference.md

@@ -0,0 +1,49 @@
+# API Reference: Analyzing Cobalt Strike Beacon Config
+
+## Overview
+
+`scripts/analyst.py` brute-forces the single-byte XOR key protecting a Beacon configuration
+block, locates the TLV settings table, and parses a well-known subset of settings (C2 server,
+URIs, sleep/jitter, watermark, pipe name). It reads bytes only.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | struct, JSON |
+
+## External tools
+
+| Tool | Purpose |
+|------|---------|
+| CobaltStrikeParser (community) | Reference config parsing across versions |
+| 1768.py (Didier Stevens) | Alternative beacon config extractor |
+
+## Core functions
+
+### `extract_config(data)`
+Tries XOR keys 1–255, finds the decoded settings table (anchored on the BeaconType entry),
+and returns the parsed config plus the recovered key.
+
+### `_parse_table(buf)`
+Walks TLV entries (index, type, length, value), mapping known indices to names. Returns
+`None` on malformed data so the brute-force can reject wrong keys.
+
+## Usage
+
+```bash
+python scripts/analyst.py parse beacon.bin
+```
+
+## Notes
+
+The setting index catalog and XOR-encoded table layout are publicly documented. This parser
+intentionally decodes a limited subset for triage; use a full community parser for complete,
+version-specific extraction.
+
+## Sources
+
+- Cobalt Strike malleable C2 documentation — https://www.cobaltstrike.com/
+- CobaltStrikeParser (community reference for config layout) —
+  https://github.com/Sentinel-One/CobaltStrikeParser
+- Publicly documented Beacon config TLV structure