BeaconSMB Listener

Overview#

BeaconSMB is an internal (bind) listener that communicates with Beacon agents over SMB named pipes. This is particularly useful for lateral movement within Windows environments where SMB traffic is normal and expected.

Characteristics#

Creating a BeaconSMB Listener#

1. Open the Listeners tab
2. Click Create
3. Select BeaconSMB
4. Configure the pipe name and binding parameters
5. Click Start

How It Works#

1. The listener creates an SMB named pipe
2. Beacon agents connect to the named pipe for C2 communication
3. Data is exchanged through the pipe using the Beacon protocol
4. Communication looks like normal SMB traffic on the network

Use Cases#

• Lateral movement — Ideal for moving between Windows machines on the same network
• Internal pivoting — Agents on segmented networks communicate through SMB
• Blending in — SMB traffic is ubiquitous in Windows domain environments
• Firewall evasion — SMB (port 445) is typically allowed between internal hosts

OPSEC Notes#

• Named pipe names should blend with legitimate Windows services
• SMB traffic between workstations may be monitored in mature security environments
• ETW (Event Tracing for Windows) can detect named pipe activity
• Consider using this as a secondary/pivot channel rather than for initial access
• Pair with a Beacon agent that already has access to the target network