zer0yu/Awesome-CobaltStrike

Features

• Command and Control - Serves as a comprehensive resource hub for deploying and managing Cobalt Strike command and control infrastructure.
• Awesome List - A community-curated directory that catalogs and links out to other open-source projects, rather than a standalone tool you run yourself.
• Network Traffic Transformers - Implements tools to modify network headers and parameters to blend C2 communication with legitimate traffic.
• Memory-Resident Execution - Implements methods to run payloads entirely within system RAM, bypassing traditional file-based antivirus scanners.
• Process Space Injection - Provides techniques for inserting malicious code into the memory space of legitimate running processes to avoid detection.
• Malleable C2 Traffic Profiles - Offers customizable communication profiles designed to mask command and control traffic by mimicking legitimate web activity.
• Payload Obfuscators - Includes tools to mask shellcode and binaries, altering their structure to evade antivirus and EDR detection.
• Post-Exploitation Frameworks - Provides frameworks for building custom memory-resident modules and reflective libraries for use on compromised hosts.
• Post-Exploitation Plugins - Provides resources for developing specialized extensions used for memory injection and credential dumping during post-exploitation.
• Security Software Evasion - Provides a suite of shellcode loaders and obfuscation techniques to bypass antivirus and endpoint detection systems.
• Reflective Memory Loading - Provides techniques for loading code directly into RAM to execute custom binaries without writing artifacts to disk.
• EDR Evasion - Supplies shellcode loaders and techniques designed to circumvent endpoint detection and response security controls.
• Offensive Security Workflows - Provides automated sequences for streamlining reconnaissance, process injection, and host enumeration tasks.
• C2 Infrastructure - Provides technical guides and resources for staging and obfuscating command and control infrastructure.
• C2 Infrastructure Managers - Curates resources for managing the setup and configuration of command and control listeners and agents.
• C2 Infrastructure Analysis - Provides tools to identify and decrypt beacons and servers using memory forensics and network telemetry.
• C2 Beacon Fingerprinting - Includes tools and methods to identify malicious servers and agents by analyzing network patterns and memory hashes.
• Memory Forensics - Provides tools for analyzing volatile memory dumps to investigate and identify malicious C2 beacons and servers.
• Post-Exploitation Toolkits - Provides a set of toolkits for maintaining access and executing custom code after initial system compromise.
• Red Team Workflow Automations - Offers orchestration systems to automate repetitive red team tasks such as reconnaissance and host enumeration.
• Red Team Resources - Curated resources specifically for the Cobalt Strike framework.
• Post Exploitation Frameworks - Curated list of Cobalt Strike extensions and resources.

Star history