[PPC] Upskilling Guide – CTA

To protect vital systems and data, organizations must create cybersecurity programs containing the right mix of security tools and skilled personnel. This is especially challenging since effective security strategies include offensive or proactive tactics, like pen testing and red teaming, which require staff members with specialized expertise and certifications. Given that the current cybersecurity skills […]

Read More… from [PPC] Upskilling Guide – CTA

Cobalt Strike Infrastructure Downtime – March 2024

The Cobalt Strike download infrastructure will be down for a short while on Wednesday 13th March for routine maintenance. Work will begin around 15:00 GMT (10:00 EST). We expect the maintenance to be completed in under 30 minutes. Downloads and updates will be unavailable while this work is carried out. Apologies for any inconvenience that […]

Read More… from Cobalt Strike Infrastructure Downtime – March 2024

Introducing the Mutator Kit: Creating Object File Monstrosities with Sleep Mask and LLVM

This is a joint blog written by William Burgess (@joehowwolf) and Henri Nurmi (@HenriNurmi). In our ‘Cobalt Strike and YARA: Can I Have Your Signature?’ blog post, we highlighted that the sleep mask is a common target for in-memory YARA signatures. In that post we recommended using the evasive sleep mask option to scramble the […]

Read More… from Introducing the Mutator Kit: Creating Object File Monstrosities with Sleep Mask and LLVM

Cobalt Strike Infrastructure Maintenance – January 2024

We will be making a small change to the Cobalt Strike infrastructure next week. This will not result in any downtime but will affect updates using old copies of the update application. TLS Certificate Update verify.cobaltstrike.com hosts a text file with SHA256 hashes for the licensed Cobalt Strike product and distribution packages for Windows, Linux […]

Read More… from Cobalt Strike Infrastructure Maintenance – January 2024

Cobalt Strike 4.9: Take Me To Your Loader

Cobalt Strike 4.9 is now available. This release sees an overhaul to Cobalt Strike’s post exploitation capabilities to support user defined reflective loaders (UDRLs), the ability to export Beacon without a reflective loader which adds official support for prepend-style UDRLs, support for callbacks in a number of built-in functions, a new in-Beacon data store and […]

Read More… from Cobalt Strike 4.9: Take Me To Your Loader

Revisiting the User-Defined Reflective Loader Part 2: Obfuscation and Masking

This is the second installment in a series revisiting the User-Defined Reflective Loader (UDRL). In part one, we aimed to simplify the development and debugging of custom loaders and introduced the User-Defined Reflective Loader Visual Studio (UDRL-VS) template. In this installment, we’ll build upon the original UDRL-VS loader and explore how to apply our own […]

Read More… from Revisiting the User-Defined Reflective Loader Part 2: Obfuscation and Masking

Core Impact Datasheet

Core Impact uses the same techniques as today’s threat actors to efficiently test the security of an IT infrastructure to help minimize risk and protect valuable assets. With the help of guided automations, organizations can discover, test, and report in just a few simple steps. Simple Enough for Your First Test, Powerful Enough for the […]

Read More… from Core Impact Datasheet

Simplifying BOF Development: Debug, Test, and Save Your B(e)acon 

Beacon Object Files (BOFs) were introduced in Cobalt Strike 4.1 in 2020. Since their release, BOFs have played a key role in post-exploitation activities, surpassing Reflective DLLs, .NET assemblies, and PowerShell scripts. However, in our experience, many developers struggle with four primary pain points: In this blog post, we will tackle these difficulties by introducing […]

Read More… from Simplifying BOF Development: Debug, Test, and Save Your B(e)acon