fox-it / dissect.cobaltstrikeLinks
Python library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles
☆174Updated 2 months ago
Alternatives and similar repositories for dissect.cobaltstrike
Users that are interested in dissect.cobaltstrike are comparing it to the libraries listed below
Sorting:
- Cobalt Strike Beacon configuration extractor and parser.☆155Updated 4 years ago
- Open Dataset of Cobalt Strike Beacon metadata (2018-2022)☆125Updated 3 years ago
- A repository that maps commonly used attacks using MSRPC protocols to ATT&CK☆335Updated 2 years ago
- MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.☆217Updated 2 years ago
- A collection of Tools and Rules for decoding Brute Ratel C4 badgers☆64Updated 3 years ago
- This repo will contain the core detection, only for Cobaltstrike's leaked versions. Non-leaked version detections wont be shared☆89Updated last year
- Load any Beacon Object File using Powershell!☆257Updated 3 years ago
- Project for identifying executables that have command-line options that can be obfuscated, possibly bypassing detection rules.☆179Updated 6 months ago
- Yapscan is a YAra based Process SCANner, aimed at giving more control about what to scan and giving detailed reports on matches.☆61Updated 2 years ago
- Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.☆117Updated 3 years ago
- ☆170Updated 4 years ago
- Simple EDR implementation to demonstrate bypass☆173Updated 5 years ago
- ☆113Updated 3 years ago
- A collection of tools and detections for the Sliver C2 Frameworj☆128Updated 2 years ago
- Finding secrets in kernel and user memory☆116Updated last year
- Execute PowerShell code at the antimalware-light protection level.☆141Updated 2 years ago
- Use to copy a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures.☆118Updated 4 years ago
- A collection of scripts for dealing with Cobalt Strike beacons in Python☆168Updated 4 years ago
- Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider☆178Updated 2 years ago
- Detect strange memory regions and DLLs☆185Updated 3 years ago
- ☆145Updated 3 years ago
- VBScript & VBA source-to-source deobfuscator with partial-evaluation☆80Updated last year
- Remove API hooks from a Beacon process.☆277Updated 3 years ago
- UI for creating LNKs☆105Updated 4 years ago
- ☆99Updated 3 years ago
- ☆222Updated 3 years ago
- A fake AMSI Provider which can be used for persistence.☆151Updated 4 years ago
- Apply a filter to the events being reported by windows event logging☆262Updated 4 years ago
- ☆147Updated 2 years ago
- Move CS beacon to GPU memory when sleeping☆246Updated 3 years ago