Blog Library
This section is a collection of blog posts presented as an extra source of information on various topics. They have been reproduced as originally published. More posts are available at https://www.cobaltstrike.com/blog
Automation and Infrastructure Deployment
Create Listeners with an Aggressor Script-listener-create-ext
Simple DNS Redirectors for Cobalt Strike
Broken Promises and Malleable C2 Profiles
Get Familiar with Aggressor Script
Beacon GATE
UDRL
User Defined Reflective Loader Part 1: Simplifying Development
User Defined Reflective Loader Part 2: Obfuscation and Masking
User Defined Reflective Loader Part 3: Beacon User Data
User Defined Reflective Loader Update in Cobalt Strike 4.5
Evasion
Introducing the Mutator Kit: Creating Object File Monstrosities with Sleep Mask and LLVM
Cobalt Strike and YARA: Can I Have Your Signature?
Behind the Mask: Spoofing Call Stacks Dynamically with Timers
Arsenal Kit Update: Thread Stack Spoofing
Sleep Mask Update in Cobalt Strike 4.5
Create a Proxy DLL with Artifact Kit
Pushing Back on Userland Hooks with Cobalt Strike
BOF Development
Simplifying BOF Development: Debug, Test, and Save Your B(e)acon
Writing Beacon Object Files: Flexible, Stealthy, and Compatible
POST-EX
Process Injection Update in Cobalt Strike 4.5
Cobalt Strike’s Process Injection: The Details
Cobalt Strike 3.14 – Post-Ex Omakase Shimasu
PowerShell Shellcode Injection on Win 10 (v1803)
Kits, Profiles, and Scripts… Oh my!
Session Passing from Cobalt Stirke
Post-Exploitation Only (Not Really)
How do I psexec without an initial Beacon?
Lateral Movement
Misc