support

Process Browser

Go to [beacon] -> Explore -> Show Processes to open the Process Browser.

The Process Browser does the obvious; it tasks a Beacon to show a list of processes and shows this information to you. The Process Browser is also a convenient place to impersonate a token from another process, deploy the screenshot tool, or deploy the keystroke logger. Highlight one or more processes and press the appropriate button at the bottom of the tab.

Process Browser

Process Browser

If you highlight multiple Beacons and task them to show processes, Cobalt Strike will show a Process Browser that also states which host the process comes from. This variant of the Process Browser is a convenient way to deploy Beacon’s post-exploitation tools to multiple systems at once. Simply sort by process name, highlight the interesting processes on your target systems, and press the Screenshot or Log Keystrokes button to deploy these tools to all highlighted systems.