internals

Creating the WhereAmI Cobalt Strike BOF

Bobby Cooke

Overview This is a walkthrough of creating the Cobalt Strike Beacon Object File (BOF) “Where Am I?” This idea was inspired by Matt Eidelberg’s DEF CON 29 talk Operation Bypass Catch My Payload If You Can. In this talk, Matt shows how EDR heuristics can detect Cobalt Strike beacons based on...