Introduction
This presentation traces the evolution of post-exploitation tradecraft, from executable files and reflective DLLs to in-memory techniques designed to balance capability, developer usability, and operational security. Pieter and Chris examine how detection risks associated with files on disk, PowerShell, foreground execution, and sacrificial processes influenced the development of Beacon Object Files and newer Cobalt Strike execution formats.
Execution
Attendees will learn how BOFs came to fruition, enabling lightweight, inline execution within Beacon but as a side-effect introducing development constraints, including limited library support, dynamic function resolution, and the absence of structured exception handling.
The session explores ongoing research into post-ex execution and features recently introducted in Cobalt Strike 4.13. How BOF-PEs fit into the picture and address many of BOF’s restrictions by supporting fully linked Windows executables and DLLs, external libraries, conventional Windows imports, C++ features, and languages such as Rust.
The presentation also looks under the hood of the Cobalt Strike Interpreter, a virtual machine that compiles C scripts into intermediate bytecode for execution inside Beacon. It concludes with asynchronous post-exploitation patterns and the growing role of AI in generating, converting, and organizing post-exploitation capabilities.
