cobaltstrike

https://github.com/b3nguang/CS-Dingtalk-Bot

NtDumpBOF

BOF port of the tool NativeDump which dump lsass using only Native APIs

DojoLoader — Generic PE Loader for Prototyping Evasion Techniques

This is a versatile PE loader designed for prototyping evasion techniques. It supports downloading and executing encrypted shellcode, dynamic IAT hooking, and three Sleep obfuscation methods. Ideal for use with UDRL-less Beacon payloads from Cobalt Strike.

Blog Post:
https://www.naksyn.com/cobalt%20strike/2024/07/02/raising-beacons-without-UDRLs-teaching-how-to-sleep.html

Source:
https://github.com/naksyn/DojoLoader

#cobaltstrike #udrl #memory #evasion

Injecting Malicious Code into PDF Files and PDF Dropper Creation

https://cti.monster/blog/2024/07/25/pdfdropper.html

https://github.com/Tw1sm/SQL-BOF

https://github.com/Crypt0s/DelegationBOF

Creating Object File Monstrosities with Sleep Mask and LLVM

The Mutator kit is now part of the Cobalt Strike Arsenal Kit. It allows you to mutate BOFs, sleep masks and more with LLVM.

🔗 https://www.cobaltstrike.com/blog/introducing-the-mutator-kit-creating-object-file-monstrosities-with-sleep-mask-and-llvm

NIM loader Cobalt Strike

https://github.com/yutianqaq/CSx3Ldr

Create Reflective DLL for Cobalt Strike with GOLANG

https://sokarepo.github.io//redteam/2023/10/11/create-reflective-dll-for-cobaltstrike.html

Stealth redirector for your red team operation security

https://github.com/D00Movenok/BounceBack

BOFRYPTOR: ENCRYPTING YOUR BEACON DURING BOF EXECUTION TO AVOID MEMORY SCANNERS

https://github.com/securifybv/BOFRyptor

Taking a quick look at the new Aggressor callbacks in Cobalt Strike 4.9.

https://rastamouse.me/cobalt-strike-aggressor-callbacks/

BooM 💥

Cobalt Strike 4.9: Take Me To Your Loader

https://www.cobaltstrike.com/blog/cobalt-strike-49-take-me-to-your-loader

Red Team C2 Log Visualization (include Cobalt Strike)

https://github.com/cisagov/RedEye

https://github.com/Octoberfest7/CVE-2023-36874_BOF

Weaponized CobaltStrike BOF for CVE-2023-36874 Windows Error Reporting LPE

Run BOFs written for Cobalt Strike in Brute Ratel C4

https://blog.nviso.eu/2023/07/17/introducing-cs2br-pt-ii-one-tool-to-port-them-all/

https://github.com/NVISOsecurity/cs2br-bof

MSI BOF LPE

https://www.mandiant.com/resources/blog/privileges-third-party-windows-installers


https://github.com/mandiant/msi-search