pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

CrossC2Kit

CrossC2 Kit README | 中文文档 CrossC2Kit is an infiltration expansion around the Unix platform derived from CrossC2. Use Aggressor Script Open Source Script engine. It can be used to create automation to simulate the operation process of the Red Team and expand the CobaltStrike client. CrossC2Kit is...

StayKit

StayKit - Cobalt Strike persistence kit StayKit is an extension for Cobalt Strike persistence by leveraging the executeassembly function with the SharpStay .NET assembly. The aggressor script handles payload creation by reading the template files for a specific execution type. IMPORTANT: To use t...

AggressorScripts

Aggressor Scripts Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources AllInOne.cna v1 - Removed and outdated All purpose script to enhance the user's experience with cobaltstrike. Custom menu creation, Logging, Persistence, Enumeration, and 3rd party script...

AggressorAssessor

Various initial recon aggressor scripts...

LSTAR-EN

LSTAR - Aggressor Translated to English! By Google Translate and Deepl For the purpose of simplifying CS right-click and facilitating self-integration, refer to a large number of post-infiltration plugins Refactored and enriched host-related credential acquisition, multi-level intranet penetratio...

Ledger

Ledger — Operational Change Tracker Aggressor Script Ledger is a Cobalt Strike aggressor script that tracks every operational change made during an engagement. Every service you enable, firewall rule you punch through, account you create, or registry key you touch gets logged with a risk score,...

Cohab_Processes

CohabProcesses This Aggressor script is intended to help internal Red Teams identify suspicious or foreign processes "Cohabitation" running in their environments. Red Teams may assemble a list of "known" processes either independently or in collaboration with Blue force and feed it to the aggress...

beacon_health_check

Beacon Health Check Aggressor Script Joe Vest Twitter: @joevest Description This aggressor script uses a beacon's note field to indicate the health status of a beacon. This is done by ... Tracking each beacon's current sleep/jitter time Calculating health based on a "max expected check in time"...

CVE-2018-15982

Credits @Ridter https://github.com/Ridter/CVE-2018-15982EXP @prsecurity https://github.com/prsecurity/CVE-2018-15982 Description Aggressor Script to launch an Internet Explorer driveby attack using CVE-2018-15982 exploit for Flash player. Affected Product Versions Adobe Flash Player Host...

pyCobaltHound

Quick summary pyCobaltHound is an Aggressor script extension for Cobalt Strike which aims to provide a deep integration between Cobalt Strike and Bloodhound. pyCobaltHound strives to assists red team operators by: Automatically querying the BloodHound database to discover escalation paths opened ...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

CobaltStrike-Toolset

CobaltStrike-Toolset Aggressor Script, Kit, Malleable C2 Profiles, External C2 and so on Kits ResourceKit ExploitKit Aggressor Script chromedumpmimikatz.cna...

LSTAR

LSTAR - Aggressor A plugin from initial access to domain takeover, enabling intranet traversal With the goal of simplifying CS right-click operations and facilitating integration, referencing a large number of post-exploitation plugins Restructured and enriched host credential acquisition,...

Registry-Recon

Registry-Recon Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon. Author: Jess Hires Description As a red-team practitioner, we are often using tools that attempt to fingerprint details about a compromised system, preferably in the most stealthy way possible. Some of our usual...

Beaconator

Beaconator Beaconator is an aggressor script for Cobalt Strike used to generate either staged or stageless shellcode and packing the generated shellcode using your tool of choice. Currently, it supports the following tools: Staged Beacon Generator Alaris Stageless Beacon Generator PEzor ScareCrow...

CSSG

CSSG Cobalt Strike Shellcode Generator Ryan Stephenson RCStep Adds Shellcode - Shellcode Generator to the Cobalt Strike top menu bar CSSG is aggressor, .NET, and python scripts used to more easily generate and format beacon shellcode Generates beacon stageless shellcode with exposed exit method,...

aggrokatz

aggrokatz 这是什么 aggrokatz 是一个用于 CobaltStrike 的 Aggressor 插件扩展，它使 pypykatz 能够远程与 beacon 交互。 当前版本的 aggrokatz 允许 pypykatz 解析 LSASS 转储文件和注册表配置单元文件，以提取凭据和其他机密，而无需下载文件，也无需向 beacon 上传任何可疑代码（Cobalt Strike 本身已在运行）。 未来，该项目旨在为隐蔽操作提供更多功能，例如搜索和解密所有 DPAPI 机密/kerberoasting 等。 我们为此工具发布了一篇简短的 博客文章，其中包含一些截图。 重要说明 -...

CVE-2018-4878

Author and Credits Author: Vincent Yiu @vysecurity Credits: @evi1cg: Helping me test and keep me motivated @smgoreli: Original Calc.exe PoC @kbandla: He knows, and I know. ; Disclaimer Developed to encourage more Aggressor script development. Use only in authorized penetration testing! Descriptio...

CVE-2025-50154-Aggressor-Script

LNK Weaponizer - Cobalt Strike Aggressor Script A comprehensive Cobalt Strike Aggressor script that weaponizes and executes malicious LNK files and Library-MS files for SMB NTLMv2-SSP hash disclosure. Includes CVE-2025-24054 bypass techniques. ⚠️ DISCLAIMER This tool is for educational and researc...