cobaltstrike

Creating Object File Monstrosities with Sleep Mask and LLVM The Mutator kit is now part of the Cobalt Strike Arsenal Kit. It allows you to mutate BOFs, sleep masks and more with LLVM. 🔗 https://www.cobaltstrike.com/blog/introducing-the-mutator-kit-creating-object-file-monstrosities-with-sleep-mask-and-llvm

NIM loader Cobalt Strike https://github.com/yutianqaq/CSx3Ldr

Create Reflective DLL for Cobalt Strike with GOLANG https://sokarepo.github.io//redteam/2023/10/11/create-reflective-dll-for-cobaltstrike.html

Stealth redirector for your red team operation security https://github.com/D00Movenok/BounceBack

BOFRYPTOR: ENCRYPTING YOUR BEACON DURING BOF EXECUTION TO AVOID MEMORY SCANNERS https://github.com/securifybv/BOFRyptor

Taking a quick look at the new Aggressor callbacks in Cobalt Strike 4.9. https://rastamouse.me/cobalt-strike-aggressor-callbacks/

Cobalt Strike 4.9: Take Me To Your Loader https://www.cobaltstrike.com/blog/cobalt-strike-49-take-me-to-your-loader

Red Team C2 Log Visualization (include Cobalt Strike) https://github.com/cisagov/RedEye

https://github.com/Octoberfest7/CVE-2023-36874_BOF Weaponized CobaltStrike BOF for CVE-2023-36874 Windows Error Reporting LPE

Run BOFs written for Cobalt Strike in Brute Ratel C4 https://blog.nviso.eu/2023/07/17/introducing-cs2br-pt-ii-one-tool-to-port-them-all/ https://github.com/NVISOsecurity/cs2br-bof

MSI BOF LPE https://www.mandiant.com/resources/blog/privileges-third-party-windows-installers https://github.com/mandiant/msi-search

Winsocket implementation for Cobalt Strike. Used to communicate with the victim using winsockets instead of the traditional ways. https://github.com/WKL-Sec/Winsocky/

BOFMask BOFMask is a tool designed to conceal Cobalt Strike's Beacon payload while executing a Beacon Object File (BOF). By applying a XOR mask and modifying memory protection settings, BOFMask enables users to execute BOFs without exposing Beacon, thereby avoiding detection by EDR products that scan system memory. Research: https://securityintelligence.com/posts/how-to-hide-beacon-during-bof-execution/ Source: https://github.com/xforcered/bofmask

Reviewed, Modified RunCoff arguments. Added Cleanup for beacon compatability failure, and ran code beautifier on the C# https://github.com/trustedsec/CS_COFFLoader

Chinese Threat Actor Used Modified Cobalt Strike Variant to Attack Taiwanese Critical Infrastructure https://blog.eclecticiq.com/chinese-threat-actor-used-modified-cobalt-strike-variant-to-attack-taiwanese-critical-infrastructure