ridter/malleable-cs-profiles

This is a collection of Python tools for red team operators and security researchers who use Cobalt Strike, a popular penetration testing tool. The project helps users create "OPSEC-safe" configuration profiles that make Cobalt Strike's beacons (the agent that runs on a target machine) harder for security software like EDR (Endpoint Detection and Response) systems to detect. At a high level, the tools work by modifying the code that Cobalt Strike injects into a target system to make it look less suspicious. One script adds junk instructions at the beginning of the code to throw off pattern-matching detection. Another script analyzes a legitimate Windows DLL file and generates configuration so the malicious code blends in and looks like a normal system component. A third script generates safe values for file headers that need to remain readable for the code to function but can still trigger security alarms if not handled carefully. The target audience is professional penetration testers and red teamers who conduct authorized security assessments. For example, if a red team is simulating an attack and their Cobalt Strike beacon keeps getting caught by a company's antivirus, they would use these tools to modify the beacon's profile so it slips past defenses undetected. The project also includes three ready-to-use profile templates that users can plug directly into their Cobalt Strike server. It is worth noting that two of the scripts in the project are marked as deprecated, meaning they no longer work as intended or have become obsolete. The project also ties into a detailed blog post series that explains the underlying concepts. These tools sit firmly in the offensive security space and assume the user already has a working understanding of how Cobalt Strike operates.