spawn
by boku7
Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (ACG), BlockDll, and PPID spoofing.
AI summary
Process spawner
A Cobalt Strike Beacon tool that spawns a sacrificial process to execute shellcode, using techniques like Arbitrary Code Guard and PPID spoofing to evade detection.
- stars
- 440
- forks
- 70
- watching
- 13
Similar projects
Found by comparing what the projects do, not just their names.
System info BOF
A Cobalt Strike Beacon Object File (BOF) that uses custom syscaller code to make direct system calls to retrieve process information on the target system.
Process hook remover
Removes API hooks from a malicious process
Shellcode injector
A tool that enables remote process shellcode execution using the Early Bird injection technique
Payload loader
Loads and executes a malicious payload in a Windows system using PowerShell.
BOF executable generator
A Beacon Object File Visual Studio template project for creating malicious code executables
AMSIBypass Tool
A tool that bypasses AMSI in a remote process with code injection.
ETW bypass tool
Tool to bypass ETW (Event Tracing for Windows) security measure in remote processes by injecting a custom syscall
Beacon utilities
Utilities for Cobalt Strike's Beacon Object Files to simplify working with shellcode and system processes
Process enumerator
An exploit tool that uses direct system calls to enumerate processes based on specific loaded modules or process handles
Malicious connection maker
A Cobalt Strike beacon implementation in Rust for creating malicious network connections
DLL hijacker
A CobaltStrike payload that uses DLL hijacking to spawn additional Beacons on Windows systems
Packet simulator
A tool to simulate a Cobalt Strike beacon connection packet by parsing the payload and extracting RSA public key
Intrusion tool
An aggressor script that allows Cobalt Strike to perform process injection and persistence by leveraging direct syscalls to bypass EDR/AV systems.
Cobalt strike payloads
Beacon object files for Cobalt Strike
Call Stack Spoofer
A proof-of-concept technique for dynamically spoofing an application's call stack using timers.
