Cobalt Strike beacon

beacon> shell whoami

Executes commands on the compromised host from the beacon console: the interactive interface of the most used C2 in red teaming.

Run it when the beacon is already implanted and you need to interact with the host: enumerate, move laterally, or launch modules. The shell command executes in a remote cmd and the output returns to the operator without touching the target's disk.

If the EDR has detections for Cobalt Strike's default named pipes (MSSE-, postex_, msagent_) or vanilla HTTP profiles, the beacon gets flagged quickly. For one-off tasks, an open-source C2 or direct SSH leaves less of a signature.