Repositories list

• community_kit

  Public

  Cobalt-Strike/community_kit’s past year of commit activity
  Cobalt Strike is a post-exploitation framework designed to be extended and customized by the user community. Several excellent tools and scripts have been writt…

  CSS

  •

  Apache License 2.0

  •29•408•0•0•Updated Mar 27, 2026Mar 27, 2026

• eden

  Public

  Cobalt-Strike/eden’s past year of commit activity
  A PoC UDRL for Cobalt Strike built with Crystal Palace that combines Raphael Mudge's page streaming technique with a modular call gate (Draugr)

  C

  •

  Apache License 2.0

  •6•111•1•0•Updated Jan 21, 2026Jan 21, 2026

• cobaltstrike-web-client

  Public

  Cobalt-Strike/cobaltstrike-web-client’s past year of commit activity
  A PoC web interface for interacting with Cobalt Strike through its REST API.

  HTML

  •2•6•0•0•Updated Jan 14, 2026Jan 14, 2026

• sleep2rest

  Public

  Cobalt-Strike/sleep2rest’s past year of commit activity
  Library that provides Aggressor Script functions for interacting with the Cobalt Strike REST API from the client

  Apache License 2.0

  •1•3•0•0•Updated Dec 19, 2025Dec 19, 2025

• cobaltstrike-mcp-server

  Public

  Cobalt-Strike/cobaltstrike-mcp-server’s past year of commit activity
  MCP Server for Cobalt Strike interaction.

  Python

  •

  Apache License 2.0

  •5•15•0•2•Updated Dec 19, 2025Dec 19, 2025

• .github

  Public

  Cobalt-Strike/.github’s past year of commit activity
  0•0•0•0•Updated Dec 15, 2025Dec 15, 2025

• py2rest

  Public

  Cobalt-Strike/py2rest’s past year of commit activity
  Library that provides Python examples for interacting with the Cobalt Strike REST API

  Jupyter Notebook

  •

  Apache License 2.0

  •3•24•0•0•Updated Nov 26, 2025Nov 26, 2025

• bof_template

  Public

  Cobalt-Strike/bof_template’s past year of commit activity
  A Beacon Object File (BOF) is a compiled C program, written to a convention that allows it to execute within a Beacon process and use internal Beacon APIs. BOFs…

  C

  •

  Apache License 2.0

  •26•257•0•0•Updated Nov 24, 2025Nov 24, 2025

• Malleable-C2-Profiles

  Public

  Cobalt-Strike/Malleable-C2-Profiles’s past year of commit activity
  Malleable C2 is a domain specific language to redefine indicators in Beacon's communication. This repository is a collection of Malleable C2 profiles that you m…

  421•255•0•0•Updated Nov 24, 2025Nov 24, 2025

• icmp-udc2

  Public

  Cobalt-Strike/icmp-udc2’s past year of commit activity
  UDC2 implementation that provides an ICMP C2 channel

  Python

  •17•118•0•0•Updated Nov 24, 2025Nov 24, 2025

• udc2-vs

  Public
  User-Defined C2 BOF Template

  Python

  •

  Apache License 2.0

  •4•30•0•0•Updated Nov 24, 2025Nov 24, 2025

• sleepmask-vs

  Public
  A simple Sleepmask BOF example

  C++

  •

  Apache License 2.0

  •30•173•0•0•Updated Nov 24, 2025Nov 24, 2025

• bof-vs

  Public

  Cobalt-Strike/bof-vs’s past year of commit activity
  A Beacon Object File (BOF) template for Visual Studio

  C++

  •

  Apache License 2.0

  •38•274•1•2•Updated Nov 24, 2025Nov 24, 2025

• aggressor_script_examples

  Public

  Cobalt-Strike/aggressor_script_examples’s past year of commit activity
  This repository contains tips, tricks, and examples of aggressor script functions. The intent is to share bite size examples that can be used in other scripts.

  Apache License 2.0

  •10•16•0•0•Updated Aug 12, 2025Aug 12, 2025

• teamserver-prop

  Public

  Cobalt-Strike/teamserver-prop’s past year of commit activity
  TeamServer.prop is an optional properties file used by the Cobalt Strike teamserver to customize the settings used to validate screenshot and keylog callback da…

  Apache License 2.0

  •17•69•0•0•Updated Aug 5, 2025Aug 5, 2025

• sleep_python_bridge

  Public

  Cobalt-Strike/sleep_python_bridge’s past year of commit activity
  This project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need for for the …

  Python

  •

  Apache License 2.0

  •32•187•0•0•Updated Aug 3, 2025Aug 3, 2025

• External-C2

  Public

  Cobalt-Strike/External-C2’s past year of commit activity
  External C2 is a specification to allow third-party programs to act as a communication layer for Cobalt Strike’s Beacon payload.

  C

  •

  BSD 3-Clause "New" or "Revised" License

  •2•15•0•0•Updated Jul 17, 2025Jul 17, 2025

• callback_examples

  Public

  Cobalt-Strike/callback_examples’s past year of commit activity
  This contains a number of examples demonstrating how to use callback functions in supported aggressor script functions

  C

  •

  Apache License 2.0

  •3•38•0•0•Updated Mar 17, 2025Mar 17, 2025

• obfuscator-llvm

  Public

  Cobalt-Strike/obfuscator-llvm’s past year of commit activity
  C++

  •

  Other

  •69•57•0•0•Updated Jan 15, 2024Jan 15, 2024

• CallStackMasker

  Public
  A PoC implementation for dynamically masking call stacks with timers.

  C++

  •38•310•0•0•Updated Feb 13, 2023Feb 13, 2023

• unhook-bof

  Public

  Cobalt-Strike/unhook-bof’s past year of commit activity
  Remove API hooks from a Beacon process.

  C

  •

  BSD 3-Clause "New" or "Revised" License

  •62•76•0•0•Updated Mar 13, 2022Mar 13, 2022

• ProxyDLLExample

  Public

  Cobalt-Strike/ProxyDLLExample’s past year of commit activity
  code for the Proxy DLL example blog post

  C

  •

  Apache License 2.0

  •15•63•0•0•Updated Oct 29, 2021Oct 29, 2021

• beacon_health_check

  Public
  This aggressor script uses a beacon's note field to indicate the health status of a beacon.

  Apache License 2.0

  •23•141•0•0•Updated Sep 29, 2021Sep 29, 2021

• cortana-scripts

  Public
  A collection of Cortana scripts that you may use with Armitage and Cobalt Strike 2.x. Cortana Scripts are not compatible with Cobalt Strike 3.x. Cobalt Strike 3…

  Java

  •288•2•0•0•Updated Mar 2, 2021Mar 2, 2021

• sleep

  Public
  Automatically exported from code.google.com/p/sleep

  Java

  •

  BSD 3-Clause "New" or "Revised" License

  •18•1•0•0•Updated Oct 30, 2020Oct 30, 2020

• ZeroLogon-BOF

  Public

  Cobalt-Strike/ZeroLogon-BOF’s past year of commit activity
  C

  •

  BSD 3-Clause "New" or "Revised" License

  •38•12•0•0•Updated Sep 17, 2020Sep 17, 2020

• CVE-2020-0796-BOF

  Public

  Cobalt-Strike/CVE-2020-0796-BOF’s past year of commit activity
  C

  •20•5•0•0•Updated Sep 17, 2020Sep 17, 2020

• ElevateKit

  Public

  Cobalt-Strike/ElevateKit’s past year of commit activity
  The Elevate Kit demonstrates how to use third-party privilege escalation attacks with Cobalt Strike's Beacon payload.

  PowerShell

  •204•126•0•0•Updated Jun 22, 2020Jun 22, 2020

• vncdll

  Public

  Cobalt-Strike/vncdll’s past year of commit activity
  Stand-alone VNC server compiled as a Reflective DLL

  C

  •

  GNU General Public License v2.0

  •60•5•0•0•Updated Apr 20, 2019Apr 20, 2019