Skip to content

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
 
 
 
 
 
 
 
 

Repository files navigation

WIP BOF Conversion of CCob's ThreadlessInject Technique

In my adventures making various POCs using Mockingjay I was bummed to find out, to my understanding at least, it's only threadless unless you spawn your target process, which is an IOC in and of itself. I was super excited to work with threadless process injection as it's a removal of a major IOC (thread creation and execution primitive) and evasive of ETW-Ti, so I did some digging and found CCob's amazing work from earlier this year.

This is my attempt to convert that work into a Cobalt Strike Beacon Object File (BOF), which like everything else I will update to incrementally add evasion features as I test against EDR.

About

(Still in DEV) Cobalt Strike Beacon Object File (BOF) Conversion of CCob's Awesome ThreadlessInject Process Injection Technique

Resources

Stars

Watchers

Forks

Releases

Packages

Used by

Contributors

Languages