A simple proof of concept for detecting use of Cobalt Strike's execute-assembly - View it on GitHub