BOF Collection for Cobalt Strike

BOF Collection — 15 Beacon Object Files

Curated collection of BOFs compiled and with source code for operations of red team:

n
• Enumeration (5 BOFs) — netLocalGroupMembers, netSessionEnum, ldapSearch, dnsQuery, regQuery.
n
• Credential Access (4 BOFs) — nanodump (minidump LSASS without Dbghelp.dll), chromiumCredentials, wifiPasswords, dpapiBlobDecrypt.
n
• Lateral Movement (3 BOFs) — scShell (service-based execution), wmiExec (WMI process createste), schtasksExec.
n
• Defense Evasion (3 BOFs) — etw_patch (desenables ETW), amsi_patch (bypass AMSI in process actual), unhookNtdll (restaura ntdll from disk).
n

Each BOF includes: .or compilesdo, source code .c, aggressor script .cna for integration with CS, and documentation of uso.