C2 Beaconing Detected (Cobalt Strike / Sliver / Generic)

What this playbook does

C2 Beaconing Detected (Cobalt Strike / Sliver / Generic) guides the responder from the initial signal through containment, evidence capture and verifiable close. Each step records who did what and when, so the work finishes with an audit trail you can hand to a regulator, an insurer, or your own board.

Cyber Toolbox does not detect the event — it assumes your monitoring tools, an external alert or a phone call already surfaced it. Once you have the signal, this playbook is the structured response: pick it, walk it across the affected assets, and promote it to a managed case the moment it earns one.

This is a Community playbook — free to walk against your own assets on every plan, including the free tier.

When you open it

A response is created in the app, linking the asset you're working to this playbook. The walker takes you step by step — you capture the inputs each step asks for (logs pulled, screenshots, decisions made), promote to a case if it earns one, and close with a defensible record you can export.