Remote kernel debugging "lateral movement" via WMI. An example of one of the many use cases for new #PowerShell BCD module (still in very early stages).
https://github.com/mattifestation/BCD
https://github.com/mattifestation/BCD
Db_hEGSVMAIPcbb.jpg
260.9 KB
Run a CobaltStrike beacon from a Microsoft Signed Binary vsjitdebugger.exe
https://vincentyiu.co.uk/cobaltsplunk/
Cobalt Strike Splunk Application for CobaltStrike available here https://github.com/vysec/CobaltSplunk. It parses Cobalt Strike logs, and has some predefined dashboards and queries
Cobalt Strike Splunk Application for CobaltStrike available here https://github.com/vysec/CobaltSplunk. It parses Cobalt Strike logs, and has some predefined dashboards and queries
if youre CS instances under attack, block public atttackers:
curl -X POST -d "tag=COBALT_STRIKE_SCANNER_HIGH" https://api.greynoise.io/v1/query/tag | python -m json.tool | grep "ip" | cut -d ":" -f 2 | cut -d '"' -f 2 | sort -u | grep -e '^\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}$' | sed -e 's/^/sudo iptables -I INPUT -s /g' | sed -e 's/$/\/32 -j DROP/g'ProcessTree.cna - cobaltstrike aggressor noscript to build a process tree. Based off @r3dQu1nn's ProcessColor.cna for better session prepping and OpSec. https://github.com/ars3n11/Aggressor-Scripts
GitHub
GitHub - ars3n11/Aggressor-Scripts: Cobalt Strike aggressor noscripts
Cobalt Strike aggressor noscripts. Contribute to ars3n11/Aggressor-Scripts development by creating an account on GitHub.
https://github.com/JPCERTCC/aa-tools/blob/master/cobaltstrikescan.py
Volatility plugin for cobaltstrike beacon forensic
http://www.jpcert.or.jp/magazine/acreport-cobaltstrike.html
Volatility plugin for cobaltstrike beacon forensic
http://www.jpcert.or.jp/magazine/acreport-cobaltstrike.html
GitHub
aa-tools/cobaltstrikescan.py at master · JPCERTCC/aa-tools
Artifact analysis tools by JPCERT/CC Analysis Center - aa-tools/cobaltstrikescan.py at master · JPCERTCC/aa-tools
Little exfil C# tool for compressing, encrypting, and uploading data to Dropbox. Works great using "execute-assembly" in Cobalt Strike.
https://github.com/P1CKLES/SharpBox
https://github.com/P1CKLES/SharpBox
GitHub
GitHub - P1CKLES/SharpBox: SharpBox is a C# tool for compressing, encrypting, and exfiltrating data to DropBox using the DropBox…
SharpBox is a C# tool for compressing, encrypting, and exfiltrating data to DropBox using the DropBox API. - GitHub - P1CKLES/SharpBox: SharpBox is a C# tool for compressing, encrypting, and exfil...