nopowershell

NoPowerShell NoPowerShell is a tool implemented in C which supports executing PowerShell-like commands while remaining invisible to any PowerShell logging mechanisms. This .NET Framework 2 compatible binary can be loaded in Cobalt Strike to execute commands in-memory. No...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

LSTAR-EN

LSTAR - Aggressor Translated to English! By Google Translate and Deepl For the purpose of simplifying CS right-click and facilitating self-integration, refer to a large number of post-infiltration plugins Refactored and enriched host-related credential acquisition, multi-level intranet penetratio...

LSTAR

LSTAR - Aggressor A plugin from initial access to domain takeover, enabling intranet traversal With the goal of simplifying CS right-click operations and facilitating integration, referencing a large number of post-exploitation plugins Restructured and enriched host credential acquisition,...

CVE-2018-15982

Credits @Ridter https://github.com/Ridter/CVE-2018-15982EXP @prsecurity https://github.com/prsecurity/CVE-2018-15982 Description Aggressor Script to launch an Internet Explorer driveby attack using CVE-2018-15982 exploit for Flash player. Affected Product Versions Adobe Flash Player Host...

beacon_health_check

Beacon Health Check Aggressor Script Joe Vest Twitter: @joevest Description This aggressor script uses a beacon's note field to indicate the health status of a beacon. This is done by ... Tracking each beacon's current sleep/jitter time Calculating health based on a "max expected check in time"...

Cohab_Processes

CohabProcesses This Aggressor script is intended to help internal Red Teams identify suspicious or foreign processes "Cohabitation" running in their environments. Red Teams may assemble a list of "known" processes either independently or in collaboration with Blue force and feed it to the aggress...

AggressorScripts

Aggressor Scripts Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources AllInOne.cna v1 - Removed and outdated All purpose script to enhance the user's experience with cobaltstrike. Custom menu creation, Logging, Persistence, Enumeration, and 3rd party script...

Beaconator

Beaconator Beaconator is an aggressor script for Cobalt Strike used to generate either staged or stageless shellcode and packing the generated shellcode using your tool of choice. Currently, it supports the following tools: Staged Beacon Generator Alaris Stageless Beacon Generator PEzor ScareCrow...

CrossC2Kit

CrossC2 Kit README | 中文文档 CrossC2Kit is an infiltration expansion around the Unix platform derived from CrossC2. Use Aggressor Script Open Source Script engine. It can be used to create automation to simulate the operation process of the Red Team and expand the CobaltStrike client. CrossC2Kit is...

CSSG

CSSG Cobalt Strike Shellcode Generator Ryan Stephenson RCStep Adds Shellcode - Shellcode Generator to the Cobalt Strike top menu bar CSSG is aggressor, .NET, and python scripts used to more easily generate and format beacon shellcode Generates beacon stageless shellcode with exposed exit method,...

Registry-Recon

Registry-Recon Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon. Author: Jess Hires Description As a red-team practitioner, we are often using tools that attempt to fingerprint details about a compromised system, preferably in the most stealthy way possible. Some of our usual...

pyCobaltHound

Quick summary pyCobaltHound is an Aggressor script extension for Cobalt Strike which aims to provide a deep integration between Cobalt Strike and Bloodhound. pyCobaltHound strives to assists red team operators by: Automatically querying the BloodHound database to discover escalation paths opened ...

StayKit

StayKit - Cobalt Strike persistence kit StayKit is an extension for Cobalt Strike persistence by leveraging the executeassembly function with the SharpStay .NET assembly. The aggressor script handles payload creation by reading the template files for a specific execution type. IMPORTANT: To use t...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

AggressorAssessor

Various initial recon aggressor scripts...

Ledger

Ledger — Operational Change Tracker Aggressor Script Ledger is a Cobalt Strike aggressor script that tracks every operational change made during an engagement. Every service you enable, firewall rule you punch through, account you create, or registry key you touch gets logged with a risk score,...

CVE-2018-4878

Author and Credits Author: Vincent Yiu @vysecurity Credits: @evi1cg: Helping me test and keep me motivated @smgoreli: Original Calc.exe PoC @kbandla: He knows, and I know. ; Disclaimer Developed to encourage more Aggressor script development. Use only in authorized penetration testing! Descriptio...

CVE-2025-50154-Aggressor-Script

LNK Weaponizer - Cobalt Strike Aggressor Script A comprehensive Cobalt Strike Aggressor script that weaponizes and executes malicious LNK files and Library-MS files for SMB NTLMv2-SSP hash disclosure. Includes CVE-2025-24054 bypass techniques. ⚠️ DISCLAIMER This tool is for educational and researc...

KaynStrike

KaynStrike A User Defined Reflective Loader for Cobalt Strike Beacon that spoofs the thread start address and frees itself after entry point was executed. Thread Start Address spoofing Reflective Loader cleanup Proof How to use this Just load the KaynStrike.cna agressor script and build a stagele...