I made a video showing the steps to take to decrypt Cobalt Strike traffic that I covered in my diary entry “Decrypting Cobalt Strike Traffic With Keys Extracted From Process Memory“.
Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
