BooM 💥

Creating Object File Monstrosities with Sleep Mask and LLVM

The Mutator kit is now part of the Cobalt Strike Arsenal Kit. It allows you to mutate BOFs, sleep masks and more with LLVM.

🔗 https://www.cobaltstrike.com/blog/introducing-the-mutator-kit-creating-object-file-monstrosities-with-sleep-mask-and-llvm

Injecting Malicious Code into PDF Files and PDF Dropper Creation

https://cti.monster/blog/2024/07/25/pdfdropper.html

DojoLoader — Generic PE Loader for Prototyping Evasion Techniques

This is a versatile PE loader designed for prototyping evasion techniques. It supports downloading and executing encrypted shellcode, dynamic IAT hooking, and three Sleep obfuscation methods. Ideal for use with UDRL-less Beacon payloads from Cobalt Strike.

Blog Post:
https://www.naksyn.com/cobalt%20strike/2024/07/02/raising-beacons-without-UDRLs-teaching-how-to-sleep.html

Source:
https://github.com/naksyn/DojoLoader

#cobaltstrike #udrl #memory #evasion

NtDumpBOF

BOF port of the tool NativeDump which dump lsass using only Native APIs

Voidmaw

A new technique that can be used to #bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders implemented by C2 beacons) or other problematic executables that will be flagged by the antimalware programs(such as mimikatz).

Process Inject Kit

This is a port of Cobalt Strike's Process Inject Kit from C to the C++ BOF template.

rasta-mouse/process-inject-kit
Port of Cobalt Strike's Process Inject Kit

https://github.com/rasta-mouse/process-inject-kit

Various resources to enhance Cobalt Strike's functionality and its ability to evade antivirus/EDR detection


URL：https://github.com/RedefiningReality/Cobalt-Strike