Skip to content

v4.5

Latest
Latest

Choose a tag to compare

View all tags
@Tylous Tylous released this 29 Sep 16:27
· 2 commits to main since this release
v4.5
1d02fe6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

New Features

  • Added Checkin Delay support to delay Beacon's initial check-in, breaking event-correlation heuristics on reflective load (CS 4.13+).
  • Added Client Max Post Post Size to cap POST body size for DLP bypass (CS 4.13+).
  • Added Client Max Post Get Size to control chunked data size when posting via GET header for DLP bypass (CS 4.13+).
  • Added Win10Firefox user agent group.
  • Updated all user agent strings to current 2026 versions across all groups (Chrome 150, Firefox 153, Edge 150, Safari 26.5).
  • Added Peclone_names array for cleaner PE clone name resolution.

Updates

  • Removed SmartInject from stage block (removed in CS 4.12+, still active in post-ex).
  • Removed rdll_loader from stage block (stomp loader removed in CS 4.12+, prepend loader is now default and only option).
  • Removed set name from stage PE clone entries (stomp loader export name, no longer needed with prepend loader).
  • Updated SleepMask to only emit directive when enabled, omitted entirely when set to false.
  • Updated Post-EX process dtdump.exe to w32tm.exe.

Bug Fixes

  • Fixed keystore path appending extra ".store" suffix to certificate paths.
  • Fixed debug print statement leaking TasksMaxSize value to stdout.
  • Fixed client_max_post_get_size being incorrectly applied to POST-verb HTTP templates (only valid for GET-verb templates).
Assets 6
Loading