cobaltstrike

FuckThatPacker is now integrated to CobaltStrike. You can now generate obufscated powershell payloads directly within CobaltStrike https://github.com/Unknow101/FuckThatPacker

How Cobalt Strike Became a Favorite Tool of Hackers https://www.esecurityplanet.com/threats/how-cobalt-strike-became-a-favorite-tool-of-hackers/

Implementing Syscalls in Cobalt Strike Part 1 - Battling Imports and Dependencies https://blog.xenoscr.net/2022/03/12/Implementing-Syscalls-in-Cobalt-Strike-Part-1-Battling-Imports-and-Dependencies.html

BOF and Shellcode for full DLL unhooking using dynamic syscalls https://github.com/cube0x0/SyscallPack

Parser logs created by Cobalt Strike and creates an SQLite DB which can be used to create custom reports. https://github.com/Patrick-DE/Cobaltstrike-logparser

Did someone say Cobalt Strike?

Static code analysis of CobaltStrike HTA malware sample https://tomiwa-xy.medium.com/static-code-analysis-of-cobaltstrike-hta-malware-sample-df3481b11f90

Favorite tool APT crimeware https://www.proofpoint.com/jp/blog/threat-insight/cobalt-strike-favorite-tool-apt-crimeware

Cobalt Strike Beacon Object Files (BOFs) written in rust with rust core and alloc. https://github.com/wumb0/rust_bof

BofRoast. Beacon Object File repo for roasting Active Directory https://github.com/cube0x0/BofRoast

Cobalt Strike Being Distributed to Vulnerable MS-SQL Servers https://asec.ahnlab.com/en/31811/

Detecting Cobalt Strike Beacons https://socfortress.medium.com/detecting-cobalt-strike-beacons-3f8c9fdcb654

SourcePoint v2.2 releases: polymorphic C2 profile generator for Cobalt Strike C2s https://securityonline.info/sourcepoint-polymorphic-c2-profile-generator-for-cobalt-strike-c2s/

Yeah!

Ever fancied running Cobalt Strike BOFs with Python? Using COFFLoader and BOF2shellcode you can! Blogpost and PoC: https://www.naksyn.com/injection/2022/02/16/running-cobalt-strike-bofs-from-python.html

Extracting Cobalt Strike Beacon Configurations https://elastic.github.io/security-research/intelligence/2022/01/03.extracting-cobalt-strike-beacon/article/

Staged vs Stageless payloads, what difference does it make in AV evasion? Well, someone made a comment today and I spent the last 12 hours writing a new blogpost! https://blog.spookysec.net/stage-v-stageless-1/