Malleable C2 Profiles are used by Cobalt Strike to change the built-in memory, behavioural, and network indicators of Beacon. Malleable C2 is a domain-specific language which is encapsulated in a .profile file. This profile is loaded by the Team Server on start-up and will specify how all exported payloads behave (although this can be superseded via Aggressor Script in the Cobalt Strike client, for example using a User Defined Reflective Loader). If no profile is specified, Cobalt Strike will start with the default.profile.
It's common use is to customise how network traffic looks in order to blend in and bypass egress network filtering. However, it can also be used to control what Beacon looks like in-memory, how it is reflectively loaded, and how it performs process injection, etc. To view the Malleable C2 Profile that was used when starting the Team Server from the client, select Cobalt Strike > Malleable C2 Profile.
A collection of Malleable C2 Profiles created by Raphael Mudge can be found here:
and you can find a reference profile with all the possible options available here:
Cobalt Strike provides a set of built-in commands that are used to interact with a compromised target. Each command represents one or more "tasks" that instructs Beacon to perform specific actions, and the output from these commands (if any) is shown in the Beacon console. This is the basis for all operations with Cobalt Strike.
This is the Beacon console (you can open it by double-click on row in the session view or right-click and select Interact
To get a list of available commands, type help into the Beacon console and press Enter.
To get more information about a specific command, use help <command>.