fox-it / dissect.cobaltstrikeLinks
Python library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles
☆173Updated last month
Alternatives and similar repositories for dissect.cobaltstrike
Users that are interested in dissect.cobaltstrike are comparing it to the libraries listed below
Sorting:
- Cobalt Strike Beacon configuration extractor and parser.☆154Updated 3 years ago
- Open Dataset of Cobalt Strike Beacon metadata (2018-2022)☆125Updated 3 years ago
- A repository that maps commonly used attacks using MSRPC protocols to ATT&CK☆333Updated 2 years ago
- Yapscan is a YAra based Process SCANner, aimed at giving more control about what to scan and giving detailed reports on matches.☆61Updated 2 years ago
- MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.☆214Updated 2 years ago
- A collection of Tools and Rules for decoding Brute Ratel C4 badgers☆64Updated 3 years ago
- Load any Beacon Object File using Powershell!☆256Updated 3 years ago
- This repo will contain the core detection, only for Cobaltstrike's leaked versions. Non-leaked version detections wont be shared☆89Updated last year
- Project for identifying executables that have command-line options that can be obfuscated, possibly bypassing detection rules.☆177Updated 6 months ago
- Simple EDR implementation to demonstrate bypass☆173Updated 5 years ago
- A collection of scripts for dealing with Cobalt Strike beacons in Python☆168Updated 4 years ago
- ☆170Updated 4 years ago
- ☆113Updated 3 years ago
- Finding secrets in kernel and user memory☆116Updated last year
- A collection of tools and detections for the Sliver C2 Frameworj☆128Updated 2 years ago
- Apply a filter to the events being reported by windows event logging☆262Updated 4 years ago
- Detect strange memory regions and DLLs☆185Updated 3 years ago
- An effort to track security vendors' use of Microsoft's Antimalware Scan Interface☆252Updated 3 years ago
- Another LSASS dumping tool that uses a dynamically compiled LSA plugin to grab an lsass handle and API hooking for capturing the dump in…☆265Updated 4 years ago
- Move CS beacon to GPU memory when sleeping☆246Updated 3 years ago
- Execute PowerShell code at the antimalware-light protection level.☆141Updated 2 years ago
- Pseudo-malicious usermode memory artifact generator kit designed to easily mimic the footprints left by real malware on an infected Windo…☆229Updated last year
- Remove API hooks from a Beacon process.☆276Updated 3 years ago
- Use to copy a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures.☆118Updated 4 years ago
- Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.☆117Updated 3 years ago
- Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider☆178Updated 2 years ago
- ShellWasp is a tool to help build shellcode that utilizes Windows syscalls, while overcoming the portability problem associated with Wind…☆164Updated 2 years ago
- ☆184Updated 2 years ago
- ☆143Updated 3 years ago
- Tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows☆216Updated 2 years ago