Red Team 14 min Writing Beacon Object Files: Flexible, Stealthy, and Compatible Our colleagues over at Core Security have been doing great things with Cobalt Strike, making use of it in their own engagements. They wrote up Read More
Red Team 25 min Process Injection Update in Cobalt Strike 4.5 Process injection is a core component to Cobalt Strike post exploitation. Until now, the option was to use a built-in injection technique using fork&run. This Read More
Red Team 5 min Nanodump: A Red Team Approach to Minidumps Motivation It is known that dumping Windows credentials is a technique often utilized for everyday attacks by adversaries and, consequently, Red Teamers. This process has Read More
Red Team 11 min Create a proxy DLL with artifact kit DLL attacks (hijacking, proxying, etc) are a challenge defenders must face. They can be leveraged in a Red Team engagement to help measure these defenses. Read More
Red Team 4 min How to Extend Your Reach with Cobalt Strike We’re often asked, “what does Cobalt Strike do?” In simple terms, Cobalt Strike is a post-exploitation framework for adversary simulations and Red Teaming to help Read More
Red Team, Scripting 13 min CredBandit (In memory BOF MiniDump) – Tool review – Part 1 One of the things I find fascinating about being on the Cobalt Strike team is the community. It is amazing to see how people overcome Read More
Red Team 4 min Learn Pipe Fitting for all of your Offense Projects Named pipes are a method of inter-process communication in Windows. They’re used primarily for local processes to communicate with eachother. They can also facilitate communication Read More
Red Team 8 min Pushing back on userland hooks with Cobalt Strike When I think about defense in the current era, I think of it as a game of instrumentation and telemetry. A well-instrumented endpoint provides a Read More
Red Team 5 min Agent Deployed: Core Impact and Cobalt Strike Interoperability Core Impact 20.3 has shipped this week. With this release, we’re revealing patterns for interoperability between Core Impact and Cobalt Strike. In this post, I’ll Read More
Red Team 4 min A Red Teamer Plays with JARM I spent a little time looking into Saleforce’s JARM tool released in November. JARM is an active tool to probe the TLS/SSL stack of a Read More