mgeeky/cobalt-arsenal

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1107 stars · 157 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A collection of battle-tested Aggressor Scripts (CNA) for Cobalt Strike 4.0+ that extend and enhance the red team operator's workflow. It includes utilities for automating beacon tasks, customizing uploads, improving the UI, and altering PowerShell execution patterns to evade EDR/AV detection.

Use cases

• automate commands that run when a beacon first checks in
• upload files to arbitrary remote paths from a beacon
• customize PowerShell download cradles to avoid EDR detection
• color-code file listings in the Cobalt Strike UI
• run custom commands against multiple beacons at once
• show beacon current working directory in the status bar

When to choose

• you are a red team operator using Cobalt Strike 4.0+ and want to extend its capabilities
• you need to automate repetitive beacon tasks or improve operator ergonomics
• you want to reduce noisy default PowerShell patterns that trigger EDRs

When to avoid

• you are not a licensed Cobalt Strike user, since these scripts are useless without it
• you need a general-purpose penetration testing framework rather than Cobalt Strike extensions
• you are looking for defensive/blue-team tooling

Facets

plugin · maturity active

security developer-tools workflow-automation security penetration-testing developer-tools windows cross-platform cobalt-strike aggressor-scripts red-team penetration-testing beacon cna

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mgeeky/cobalt-arsenal")