cobaltstrike

Dissecting Cobalt Strike Loader https://labs.k7computing.com/index.php/dissecting-cobalt-strike-loader/

Convert Cobalt Strike profiles to IIS web.config files https://github.com/bashexplode/cs2webconfig

Using Cloudflare Workers as Redirectors https://ajpc500.github.io/c2/Using-CloudFlare-Workers-as-Redirectors/

DNS Over HTTPS for Cobalt Strike https://www.blackhillsinfosec.com/dns-over-https-for-cobalt-strike/

information about EDRs that can be useful during red team exercise https://github.com/Mr-Un1k0d3r/EDRs/

tgtdelegation is a Beacon Object File (BOF) I just released that uses the TGT delegation trick leveraged by Kekeo and Rubeus to obtain a usable TGT in both .ccache and .kirbi formats. Since BOFs cannot link to external libraries, this tool calls the appropriate Window APIs to obtain some Kerberos data blobs and uses an Aggressor Script and Python script(s), which imports Impacket, to grab the blobs and decrypt/parse appropriately via automation. Additionally, since this uses no ASN1 libraries, we essentially do "trial-by-error" starting with AES256 then going to AES128, if AES256 fails, and then to RC4. I have found these to be the most popular encryption types, thus they are the only ones supported. Enjoy! Also credits to Rubeus, Kekeo, and Impacket for their code examples of this technique and parsing Kerberos data blobs.

tgtdelegation is a Beacon Object File (BOF) to obtain a usable TGT via the "TGT delegation trick" https://github.com/connormcgarr/tgtdelegation

A Visual Studio template used to create Cobalt Strike BOFs https://github.com/securifybv/Visual-Studio-BOF-template

CheckCert Cobalt Strike BOF - "The Issuer field can help determine if SSL/TLS inspection is in place." Really clever, great work. Obtain and parse SSL certificates https://github.com/skahwah/CheckCert

Recycled Cobalt Strike key pairs show many crooks are using same cloned installation https://www.theregister.com/2021/10/22/cobalt_strike_virustotal_key_discovery/

Decrypting Obfuscated Traffic – Part 4 https://blog.nviso.eu/2021/11/17/cobalt-strike-decrypting-obfuscated-traffic-part-4/

Move CS beacon to GPU memory when sleeping https://github.com/oXis/GPUSleep

Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2 https://github.com/Sh0ckFR/InlineWhispers2

Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (ACG), BlockDll, and PPID spoofing. https://github.com/boku7/spawn

Proof of concept Beacon Object File (BOF) that attempts to detect userland hooks in place by AV/EDR https://github.com/anthemtotheego/Detect-Hooks

A faithful transposition of the key features/functionality of @itm4n's PPLDump project as a BOF. https://github.com/EspressoCake/PPLDump_BOF

Dumping LSASS has never been so stealthy https://github.com/helpsystems/nanodump

Discussing the various methods that Cobalt Strike uses to perform process injection. https://boschko.ca/cobalt-strike-process-injection/

Module Stomping, No New Thread, HellsGate syscaller, UUID Shellcode Runner for x64 Windows 10! https://github.com/boku7/Ninja_UUID_Runner