# zer0yu/awesome-cobaltstrike **Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/zer0yu-awesome-cobaltstrike).** _How this analysis was created: the description and tags below were written by an AI model that read this project's README and public documentation pages; stars, license and language come straight from the GitHub API. The model does not read the source code._ 4,419 stars · 760 forks ## Links - GitHub: https://github.com/zer0yu/Awesome-CobaltStrike - Homepage: https://github.com/zer0yu/Awesome-CobaltStrike - awesome-repositories: https://awesome-repositories.com/repository/zer0yu-awesome-cobaltstrike.md ## Description This project is a curated collection of tools, scripts, and technical guides designed to enhance offensive security operations using Cobalt Strike. It serves as a resource hub for managing command and control infrastructure and deploying security engagements. The collection includes toolkits for evading endpoint detection and response systems, alongside libraries for automating red team tasks such as reconnaissance and host enumeration. It provides resources for developing post-exploitation frameworks, specifically focusing on the creation of reflective libraries and memory-resident code. The repository covers a broad range of operational capabilities, including network traffic customization to avoid detection, memory forensics for infrastructure analysis, and various shellcode obfuscation techniques. It also includes guides for configuring command and control servers and performing host process injection. ## Tags ### Part of an Awesome List - [Command and Control](https://awesome-repositories.com/f/awesome-lists/security/command-and-control.md) — Serves as a comprehensive resource hub for deploying and managing Cobalt Strike command and control infrastructure. - [C2 Infrastructure](https://awesome-repositories.com/f/awesome-lists/devops/c2-infrastructure.md) — Provides technical guides and resources for staging and obfuscating command and control infrastructure. - [C2 Infrastructure Managers](https://awesome-repositories.com/f/awesome-lists/devops/c2-infrastructure/c2-listener-servers/c2-infrastructure-managers.md) — Curates resources for managing the setup and configuration of command and control listeners and agents. ([source](https://github.com/zer0yu/Awesome-CobaltStrike/blob/master/README.md)) - [C2 Infrastructure Analysis](https://awesome-repositories.com/f/awesome-lists/devops/c2-infrastructure/c2-listener-servers/c2-infrastructure-managers/c2-infrastructure-analysis.md) — Provides tools to identify and decrypt beacons and servers using memory forensics and network telemetry. ([source](https://github.com/zer0yu/Awesome-CobaltStrike/blob/master/README.md)) - [Red Team Resources](https://awesome-repositories.com/f/awesome-lists/learning/red-team-resources.md) — Curated resources specifically for the Cobalt Strike framework. - [Post Exploitation Frameworks](https://awesome-repositories.com/f/awesome-lists/security/post-exploitation-frameworks.md) — Curated list of Cobalt Strike extensions and resources. ### Repository Format - [Awesome List](https://awesome-repositories.com/f/repository-format/awesome-list.md) — A community-curated directory that catalogs and links out to other open-source projects, rather than a standalone tool you run yourself. ### Networking & Communication - [Network Traffic Transformers](https://awesome-repositories.com/f/networking-communication/network-traffic-transformers.md) — Implements tools to modify network headers and parameters to blend C2 communication with legitimate traffic. ### Operating Systems & Systems Programming - [Memory-Resident Execution](https://awesome-repositories.com/f/operating-systems-systems-programming/memory-resident-execution.md) — Implements methods to run payloads entirely within system RAM, bypassing traditional file-based antivirus scanners. - [Process Space Injection](https://awesome-repositories.com/f/operating-systems-systems-programming/process-space-injection.md) — Provides techniques for inserting malicious code into the memory space of legitimate running processes to avoid detection. ### Security & Cryptography - [Malleable C2 Traffic Profiles](https://awesome-repositories.com/f/security-cryptography/malleable-c2-traffic-profiles.md) — Offers customizable communication profiles designed to mask command and control traffic by mimicking legitimate web activity. - [Payload Obfuscators](https://awesome-repositories.com/f/security-cryptography/payload-obfuscation/executable-obfuscators/payload-obfuscators.md) — Includes tools to mask shellcode and binaries, altering their structure to evade antivirus and EDR detection. - [Post-Exploitation Frameworks](https://awesome-repositories.com/f/security-cryptography/post-exploitation-frameworks.md) — Provides frameworks for building custom memory-resident modules and reflective libraries for use on compromised hosts. - [Post-Exploitation Plugins](https://awesome-repositories.com/f/security-cryptography/post-exploitation-plugins.md) — Provides resources for developing specialized extensions used for memory injection and credential dumping during post-exploitation. ([source](https://github.com/zer0yu/Awesome-CobaltStrike/blob/master/README.md)) - [Security Software Evasion](https://awesome-repositories.com/f/security-cryptography/security-configurations/security-check-bypasses/security-software-evasion.md) — Provides a suite of shellcode loaders and obfuscation techniques to bypass antivirus and endpoint detection systems. ([source](https://github.com/zer0yu/Awesome-CobaltStrike/blob/master/README.md)) - [Reflective Memory Loading](https://awesome-repositories.com/f/security-cryptography/security/operations-and-incident-response/network-intrusion-detection/detection-evasion/reflective-memory-loading.md) — Provides techniques for loading code directly into RAM to execute custom binaries without writing artifacts to disk. - [EDR Evasion](https://awesome-repositories.com/f/security-cryptography/session-token-refreshers/session-persistence/security-bypass-techniques/edr-evasion.md) — Supplies shellcode loaders and techniques designed to circumvent endpoint detection and response security controls. - [C2 Beacon Fingerprinting](https://awesome-repositories.com/f/security-cryptography/c2-beacon-fingerprinting.md) — Includes tools and methods to identify malicious servers and agents by analyzing network patterns and memory hashes. - [Memory Forensics](https://awesome-repositories.com/f/security-cryptography/memory-forensics.md) — Provides tools for analyzing volatile memory dumps to investigate and identify malicious C2 beacons and servers. - [Post-Exploitation Toolkits](https://awesome-repositories.com/f/security-cryptography/post-exploitation-toolkits.md) — Provides a set of toolkits for maintaining access and executing custom code after initial system compromise. - [Red Team Workflow Automations](https://awesome-repositories.com/f/security-cryptography/red-team-workflow-automations.md) — Offers orchestration systems to automate repetitive red team tasks such as reconnaissance and host enumeration. ### Artificial Intelligence & ML - [Offensive Security Workflows](https://awesome-repositories.com/f/artificial-intelligence-ml/agentic-workflow-automation/offensive-security-workflows.md) — Provides automated sequences for streamlining reconnaissance, process injection, and host enumeration tasks. ([source](https://github.com/zer0yu/Awesome-CobaltStrike/blob/master/README.md))