# Cobalt Strike

* <https://github.com/S1ckB0y1337/Cobalt-Strike-CheatSheet>
* <https://reconshell.com/list-of-awesome-cobaltstrike-resources/>

## Beginners guide

{% embed url="<https://www.youtube.com/watch?list=PLcjpg2ik7YT6H5l9Jx-1ooRYpfvznAInJ&v=i6tsLWrCiGE>" %}
This playlist should cover literally everything
{% endembed %}

This playlist which is a total of 11 hours, 9 minutes, and 15 seconds worth of content, you should be grateful he made it for his own tool and if you have an issue? too bad cry about it you dont have that privilege

## C2 profile

* [https://blog.zsec.uk/cobalt-strike-profiles/  ](https://blog.zsec.uk/cobalt-strike-profiles/https://github.com/rsmudge/Malleable-C2-Profiles)
* [https://github.com/rsmudge/Malleable-C2-Profiles](https://blog.zsec.uk/cobalt-strike-profiles/https://github.com/rsmudge/Malleable-C2-Profiles)

## Aggressor scripts

* <https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/agressor_script.htm>
* <https://chowdera.com/2021/02/20210204190220156W.html>
* <https://www.kingstonesecurity.com/blog/efficiency-with-aggressor>

## Dev Stuff

* [RedElk](https://github.com/outflanknl/RedELK)&#x20;
  * to log aggregation and analysis for the red team
* [RedWarden](https://github.com/mgeeky/RedWarden)&#x20;
  * to keep out blue teams

## Community kits

* <https://cobalt-strike.github.io/community_kit/>

## Sleep masks

* [https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures](https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatureshttps://adamsvoboda.net/sleeping-with-a-mask-on-cobaltstrike/https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/evading-hunt-sleeping-beacons)
* [https://adamsvoboda.net/sleeping-with-a-mask-on-cobaltstrike/  ](https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatureshttps://adamsvoboda.net/sleeping-with-a-mask-on-cobaltstrike/https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/evading-hunt-sleeping-beacons)
* [https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/evading-hunt-sleeping-beacons](https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatureshttps://adamsvoboda.net/sleeping-with-a-mask-on-cobaltstrike/https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/evading-hunt-sleeping-beacons)

### Stolen from

<https://ppn.snovvcrash.rocks/>
