analyzing-cobalt-strike-malleable-profiles
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/agent.pyusessubprocess.runto invoke a local Python script (jarm.py) for network fingerprinting. The execution uses a list of arguments rather than a shell string, which is the recommended safe practice for subprocess execution. The script path is configurable via theJARM_SCRIPTenvironment variable, a standard pattern for CLI tools. - [EXTERNAL_DOWNLOADS]: The documentation refers to well-known cybersecurity tools and repositories, including Salesforce's JARM scanner and Fox-IT's
dissect.cobaltstrike. These are trusted resources within the security research community and are used here for their intended forensic purposes.
Audit Metadata