CTA Type: Resource

London User Group

July 10th | 6:30pm |Magazzino* Whether you’re an internal or consulting red team, we’d love for you to join us for this event in London. We’ll have drinks and share stories and research to advance the UK offensive community. Join the Beacon team, Unit 42, Ouflank Founder Pieter Ceelen & Cobalt Strike’s Principal Research Lead […]

Read More… from London User Group

Dynamically Instrumenting Beacon With BeaconGate – For All Your Call Stack Spoofing Needs!

Posted on

TL;DR: In this blog we’ll demonstrate how to instrument Beacon via BeaconGate and walk through our implementations of return address spoofing, indirect syscalls, and a call stack spoofing technique, Draugr, that are now available in Sleepmask-VS. Furthermore, we’ll provide tips and tricks for developers in getting set up with Sleepmask-VS so they can write their […]

Read More… from Dynamically Instrumenting Beacon With BeaconGate – For All Your Call Stack Spoofing Needs!

Black Hat Session: Next-Generation Post-Exploitation in Cobalt Strike

Event: Black Hat USA Location: Las Vegas, Nevada Format: Arsenal Track: Malware Recent advances in Windows AI/ML APIs now enable the direct integration of AI/ML models into post-exploitation DLLs, allowing them to run within active Cobalt Strike sessions for enhanced on-target classification. This work presents two examples of such integration. The first leverages a custom-trained model […]

Read More… from Black Hat Session: Next-Generation Post-Exploitation in Cobalt Strike