trustedsec/CS-Remote-OPs-BOF

Health v2 · maintenance only

Adoption not part of the score

1183 stars · 175 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A collection of Beacon Object Files (BOFs) by TrustedSec implementing remote operations commands for Cobalt Strike, covering tasks like user management, token manipulation, ADCS certificate requests, scheduled tasks, and credential extraction. It also includes injection BOFs used for EDR detection testing.

Use cases

• run post-exploitation commands on remote Windows hosts from Cobalt Strike
• request ADCS enrollment certificates during a red team engagement
• add or disable user accounts on a remote machine via a BOF
• extract Office JWT tokens and browser-stored credentials from memory
• test EDR detection coverage against process injection techniques
• impersonate users with certificate-based make_token
• create scheduled tasks on remote hosts for persistence

When to choose

• you operate Cobalt Strike and want ready-made remote operations BOFs
• you need lightweight in-memory Windows primitives without dropping binaries to disk
• you are building or extending a red team toolchain with BOF-based commands
• you want to validate EDR detections against common offensive techniques

When to avoid

• you need a supported, production-grade tool - injection BOFs are explicitly unsupported
• you are not using Cobalt Strike or a BOF-compatible agent
• you need defensive or purely situational-awareness tooling (see CS-Situational-Awareness-BOF instead)
• your use case is unauthorized access to systems you do not own or have permission to test

Facets

library · maturity active

security developer-tools cli security penetration-testing windows windows cpp cobalt-strike beacon-object-file bof red-team offensive-security post-exploitation credential-access privilege-escalation persistence edr-testing

Member repositories

For agents

markdown · JSON · MCP: product_card(name="trustedsec/CS-Remote-OPs-BOF")