The use of non-default XOR keys means the Beacon was modified as this is not configurable in Cobalt Strike. This table shows how many times a certain XOR key is seen over the unique beacon dataset. The top two keys are the default ones used in Cobalt Strike.
