fox-it / dissect.cobaltstrikeLinks
Python library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles
☆167Updated 2 months ago
Alternatives and similar repositories for dissect.cobaltstrike
Users that are interested in dissect.cobaltstrike are comparing it to the libraries listed below
Sorting:
- Cobalt Strike Beacon configuration extractor and parser.☆153Updated 3 years ago
- Open Dataset of Cobalt Strike Beacon metadata (2018-2022)☆125Updated 3 years ago
- A repository that maps commonly used attacks using MSRPC protocols to ATT&CK☆331Updated 2 years ago
- Load any Beacon Object File using Powershell!☆254Updated 3 years ago
- Yapscan is a YAra based Process SCANner, aimed at giving more control about what to scan and giving detailed reports on matches.☆61Updated last year
- A collection of Tools and Rules for decoding Brute Ratel C4 badgers☆64Updated 2 years ago
- Simple EDR implementation to demonstrate bypass☆173Updated 5 years ago
- MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.☆213Updated 2 years ago
- Detect strange memory regions and DLLs☆184Updated 3 years ago
- A collection of scripts for dealing with Cobalt Strike beacons in Python☆168Updated 4 years ago
- ☆113Updated 3 years ago
- Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.☆117Updated 3 years ago
- Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider☆176Updated 2 years ago
- Finding secrets in kernel and user memory☆116Updated last year
- ☆169Updated 4 years ago
- Use YARA rules on Time Travel Debugging traces☆91Updated last year
- This repo will contain the core detection, only for Cobaltstrike's leaked versions. Non-leaked version detections wont be shared☆89Updated last year
- VBScript & VBA source-to-source deobfuscator with partial-evaluation☆77Updated 10 months ago
- ETW based POC to identify direct and indirect syscalls☆187Updated 2 years ago
- ☆142Updated 2 years ago
- Project for identifying executables that have command-line options that can be obfuscated, possibly bypassing detection rules.☆174Updated 4 months ago
- A Cobalt Strike Scanner that retrieves detected Team Server beacons into a JSON object☆167Updated 2 years ago
- Remove API hooks from a Beacon process.☆270Updated 3 years ago
- Another LSASS dumping tool that uses a dynamically compiled LSA plugin to grab an lsass handle and API hooking for capturing the dump in…☆265Updated 4 years ago
- Pseudo-malicious usermode memory artifact generator kit designed to easily mimic the footprints left by real malware on an infected Windo…☆227Updated last year
- An effort to track security vendors' use of Microsoft's Antimalware Scan Interface☆249Updated 3 years ago
- ☆217Updated 2 years ago
- Apply a filter to the events being reported by windows event logging☆262Updated 4 years ago
- CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files (BOF) for Cobalt Strike to perform process inject…☆233Updated 2 years ago
- A little tool to play with the Seclogon service☆315Updated 2 years ago