paranoidninja / Cobaltstrike-Detection
This repo will contain the core detection, only for Cobaltstrike's leaked versions. Non-leaked version detections wont be shared
☆89Updated last year
Alternatives and similar repositories for Cobaltstrike-Detection:
Users that are interested in Cobaltstrike-Detection are comparing it to the libraries listed below
- BadExclusionsNWBO is an evolution from BadExclusions to identify folder custom or undocumented exclusions on AV/EDR☆75Updated last year
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆51Updated last year
- Lateral Movement☆122Updated last year
- Adversary Emulation Framework☆98Updated 9 months ago
- Robust Cobalt Strike shellcode loader with multiple advanced evasion features☆123Updated last week
- ☆82Updated last year
- Cobalt Strike + Brute Ratel C4 Beacon Object File (BOF) Conversion of the Mockingjay Process Injection Technique☆151Updated last year
- Windows Persistence IT-Security☆97Updated last month
- Tool for working with Indirect System Calls in Cobalt Strike's Beacon Object Files (BOF) using SysWhispers3 for EDR evasion☆76Updated 2 weeks ago
- Create Anti-Copy DRM Malware☆55Updated 8 months ago
- Example code samples from our ScriptBlock Smuggling Blog post☆90Updated 10 months ago
- Two in one, patch lifetime powershell console, no more etw and amsi!☆88Updated this week
- A Mythic agent for Windows written in C☆119Updated this week
- Port of Cobalt Strike's Process Inject Kit☆173Updated 4 months ago
- ☆125Updated last year
- ☆116Updated last month
- ☆106Updated 2 months ago
- A variation of ProcessOverwriting to execute shellcode on an executable's section☆148Updated last year
- Curated list of public Beacon Object Files(BOFs) build in as submodules for easy cloning☆128Updated 4 months ago
- Modified versions of the Cobalt Strike Process Injection Kit☆94Updated last year
- ☆80Updated last year
- ☆125Updated 7 months ago
- Simple BOF to read the protection level of a process☆115Updated last year
- To audit the security of read-only domain controllers☆115Updated last year
- Terminate AV/EDR leveraging BYOVD attack☆83Updated last month
- ☆154Updated 4 months ago
- Do some DLL SideLoading magic☆84Updated last year
- ApexLdr is a DLL Payload Loader written in C☆108Updated 9 months ago
- Detect WFP filters blocking EDR communications☆86Updated last year
- Lateral Movement via the .NET Profiler☆81Updated 5 months ago