Behind the Mask: Spoofing Call Stacks Dynamically with Timers
This blog introduces a PoC technique for spoofing call stacks using timers. Prior to our implant sleeping, we can queue up timers to overwrite its
Celebrating 10 Years of Cobalt Strike
Can you believe it? Cobalt Strike is 10 years old! Think back to the summer of 2012. The Olympics were taking place in London. CERN
Arsenal Kit Update: Thread Stack Spoofing
As I mentioned in the recent Roadmap Update blog post, we are in the process of expanding the Cobalt Strike development team and ramping up
There’s Another New Deputy in Town
Things are moving in the Cobalt Strike world…And they are moving… FAST. When I started my position with the Cobalt Strike team, I got to
Building Upon a Strong Foundation
In the weeks ahead, Cobalt Strike 4.6 will go live and will be a minor foundational release before we move into our new development model.
Joe’s Transition
My career is taking me in a new and exciting direction, and I am stepping down from my role on the Cobalt Strike team. I’ve
Incorporating New Tools into Core Impact
Core Impact has further enhanced the pen testing process with the introduction of two new modules. The first module enables the use of .NET assemblies,
Cobalt Strike Training Options
The Cobalt Strike training web page has been updated. https://www.cobaltstrike.com/training/ The training web page lists free courses created by the Cobalt Strike team that provide
Writing Beacon Object Files: Flexible, Stealthy, and Compatible
Our colleagues over at Core Security have been doing great things with Cobalt Strike, making use of it in their own engagements. They wrote up
Process Injection Update in Cobalt Strike 4.5
Process injection is a core component to Cobalt Strike post exploitation. Until now, the option was to use a built-in injection technique using fork&run. This