Join GitHub today

GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.

Sign up

Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

Permalink

Type Name Latest commit message Commit time
Failed to load latest commit information.
DriverSearcher Added more drivers for Carbon Black Aug 23, 2018
Logging Added Newer Symantec processes Nov 8, 2017
Persistence Fixed script to show as popup item Nov 21, 2018
AVQuery.cna Fixed line 21 errors and added a pause for execution Mar 16, 2018
All_In_One.cna Remaking this completely, keep an eye out for v2 :) Feb 10, 2018
ArtifactPayloadGenerator.cna Automatic Artifact Payload Generator Jul 7, 2017
CertUtilWebDelivery.cna Updated script to use PowerPick thanks @424f424f! Sep 2, 2017
EDR.cna Added more drivers for Carbon Black Aug 22, 2018
ProcessColor.cna Added Microsoft ATP Processes Sep 13, 2018
ProcessMonitor.cna Add files via upload Oct 13, 2017
ProcessMonitor.ps1 Add files via upload Oct 13, 2017
README.md Update README.md Feb 10, 2018
RedTeamRepo.cna Update RedTeamRepo.cna Sep 4, 2017
SMBPayloadGenerator.cna SMB Artifact Payload Generator Oct 25, 2018
logvis.cna Added in real time updating Mar 23, 2018

Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

  • All_In_One.cna v1 - Removed and outdated

    • All purpose script to enhance the user's experience with cobaltstrike. Custom menu creation, Logging, Persistence, Enumeration, and 3rd party script integration.
    • Version 2 is currently in development!

  • ArtifactPayloadGenerator.cna

    • Generates every type of Stageless/Staged Payload based off a HTTP/HTTPS Listener

    • Creates /opt/cobaltstrike/Staged_Payloads, /opt/cobaltstrike/Stageless_Payloads

  • AVQuery.cna

    • Queries the Registry with powershell for all AV Installed on the target

    • Quick and easy way to get the AV you are dealing with as an attacker

    av

  • CertUtilWebDelivery.cna

    • Stageless Web Delivery using CertUtil.exe

    • Powerpick is used to spawn certutil.exe to download the stageless payload on target and execute with rundll32.exe

    certutil2

  • RedTeamRepo.cna

    • A common collection of OS commands, and Red Team Tips for when you have no Google or RTFM on hand.

    • Script will be updated on occasion, feedback and more inputs are welcomed!

    redrepo

  • ProcessColor.cna

    process