Caché Native Access (CNA)

Beacon Object File to automatically/unattended inject in one of the specified processes.

An all-in-one Cobalt Strike BOF to patch, check and revert AMSI and ETW for x64 process. Both syscalls and dynamic resolve versions are available.

Print Spooler Named Pipe Impersonation for Cobalt Strike

An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.

A BOF that runs unmanaged PEs inline

Situational Awareness commands implemented using Beacon Object Files

The swiss army knife of LSASS dumping