cobaltstrike

Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 2 https://blog.nviso.eu/2021/10/27/cobalt-strike-using-known-private-keys-to-decrypt-traffic-part-2/

DLL Hijack Search Order Enumeration BOF https://github.com/EspressoCake/DLL-Hijack-Search-Order-BOF

Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1 https://blog.nviso.eu/2021/10/21/cobalt-strike-using-known-private-keys-to-decrypt-traffic-part-1/

CVE-2021-36798 Exp: Cobalt Strike < 4.4 Dos https://github.com/JamVayne/CobaltStrikeDos

Parser Cobalt Strike malleable C2 profiles. https://github.com/brett-fitz/pyMalleableProfileParser

Hunting Cobalt Strike C2 with Shodan https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2

Pointer: Hunting Cobalt Strike globally https://medium.com/@shabarkin/pointer-hunting-cobalt-strike-globally-a334ac50619a

Detecting Cobalt Strike with memory signatures https://www.elastic.co/cn/blog/detecting-cobalt-strike-with-memory-signatures

DCOM_AV_EXEC (+ AV_Bypass_Framework_V3) https://gitlab.com/theepicpowner/dcom_av_exec

A BOF to interact with COM objects associated with the Windows software firewall. https://github.com/EspressoCake/Firewall_Walker_BOF

PIC your Katz! Say hello to HandleKatz, our position independent Lsass dumper abusing cloned handles, direct system calls and a modified version of minidumpwritedump() brought to you by @thefLinkk https://github.com/EspressoCake/HandleKatz_BOF

Defining Cobalt Strike Components So You Can BEA-CONfident in Your Analysis https://www.mandiant.com/resources/defining-cobalt-strike-components

Cobalt Strike Sleep Python Bridge https://blog.cobaltstrike.com/2021/10/13/cobalt-strike-sleep-python-bridge/

Dumping SAM / SECURITY / SYSTEM registry hives with a Beacon Object File https://github.com/EncodeGroup/BOF-RegSave

A Beacon Object File (BOF) for Cobalt Strike which uses direct system calls to enable WDigest credential caching. https://github.com/outflanknl/WdToggle