Red Team Posted on May 16, 2023 (May 16, 2023) Cobalt Strike and YARA: Can I Have Your Signature? Over the past few years, there has been a massive proliferation of YARA signatures for Beacon. We know from conversations with our customers that this Read More
Development, Red Team Posted on March 15, 2023 (March 16, 2023) Revisiting the User-Defined Reflective Loader Part 1: Simplifying Development This blog post accompanies a new addition to the Arsenal Kit – The User-Defined Reflective Loader Visual Studio (UDRL-VS). Over the past few months, we Read More
Development, Red Team Posted on February 13, 2023 (April 26, 2023) Behind the Mask: Spoofing Call Stacks Dynamically with Timers This blog introduces a PoC technique for spoofing call stacks using timers. Prior to our implant sleeping, we can queue up timers to overwrite its Read More
Red Team Posted on December 20, 2021 (June 6, 2022) Writing Beacon Object Files: Flexible, Stealthy, and Compatible Our colleagues over at Core Security have been doing great things with Cobalt Strike, making use of it in their own engagements. They wrote up Read More
Red Team Posted on December 15, 2021 (January 25, 2022) Process Injection Update in Cobalt Strike 4.5 Process injection is a core component to Cobalt Strike post exploitation. Until now, the option was to use a built-in injection technique using fork&run. This Read More
Red Team Posted on November 17, 2021 (June 6, 2022) Nanodump: A Red Team Approach to Minidumps Motivation It is known that dumping Windows credentials is a technique often utilized for everyday attacks by adversaries and, consequently, Red Teamers. This process has Read More
Red Team Posted on November 2, 2021 (May 4, 2022) Create a proxy DLL with artifact kit DLL attacks (hijacking, proxying, etc) are a challenge defenders must face. They can be leveraged in a Red Team engagement to help measure these defenses. Read More
Red Team Posted on September 13, 2021 (May 17, 2022) How to Extend Your Reach with Cobalt Strike We’re often asked, “what does Cobalt Strike do?” In simple terms, Cobalt Strike is a post-exploitation framework for adversary simulations and Red Teaming to help Read More
Red Team, Scripting Posted on July 13, 2021 (September 28, 2022) CredBandit (In memory BOF MiniDump) – Tool review – Part 1 One of the things I find fascinating about being on the Cobalt Strike team is the community. It is amazing to see how people overcome Read More
Red Team Posted on February 9, 2021 (November 29, 2022) Learn Pipe Fitting for all of your Offense Projects Named pipes are a method of inter-process communication in Windows. They’re used primarily for local processes to communicate with eachother. They can also facilitate communication Read More
