This repository offers tools and examples designed to help you get more out of Cobalt Strike. Our goal is to support researchers in pushing the limits of what the product can do—building creative, high-impact tools and techniques.
We're continually inspired by the community, which proves every day that great ideas come from collaboration and innovation beyond what we could achieve alone.
Happy Hacking!
We believe that flexibility is key to effective evasion and threat emulation. Cobalt Strike gives users the power to adapt—whether by tweaking malleable C2 profiles or going deeper with full customizations using our Arsenal Kit and Public Templates and Examples.
Whether you're modifying configurations or building custom implementations, you have the freedom to shape every stage of the attack chain.
- Sleepmask-VS: A simple Sleepmask BOF example.
- BOF-VS: A Beacon Object File (BOF) template for Visual Studio.
- BOF Template: Core files needed to create a Beacon Object File for use with Cobalt Strike.
- Malleable C2 Profiles: This repository is a collection of Malleable C2 profiles that you may use.
- Cobalt Strike Reference Profile: Profile that is meant to show all of the options available in Malleable profiles.
- External C2: Specification to allow third-party programs to act as a communication layer for Cobalt Strike’s Beacon payload.
- Aggressor Script Examples: Tips, tricks, and examples of aggressor script functions.
- Callback Examples: Examples demonstrating how to use callback functions in supported aggressor script functions.
- Cobalt Strike Community Kit: The Cobalt Strike Community Kit is a curated repository of tools written by Cobalt Strike users and is another example of the level of community that sets Cobalt Strike apart from other C2 frameworks.