trustedsec/CS-Situational-Awareness-BOF

Health v2 · maintenance only

Adoption not part of the score

1868 stars · 296 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A collection of situational awareness commands implemented as Cobalt Strike Beacon Object Files (BOFs) in C, letting operators run low-footprint host checks before more invasive actions. It also serves as a reference workflow and template for developing new BOFs.

Use cases

• enumerate AD CS certificate authorities and templates from a beacon
• check for AV/EDR drivers by signing certificates on a host
• list ARP table, sessions, and environment variables during post-exploitation recon
• learn how to write and build Beacon Object Files for Cobalt Strike
• read files and enumerate directories with wildcards from a beacon
• check Active Directory Recycle Bin status and deleted objects

When to choose

• you run Cobalt Strike and want low-overhead host enumeration without spawning processes
• you need a starting template and workflow for developing your own BOFs
• you want quick situational awareness checks like EDR detection or AD CS enumeration

When to avoid

• you use a C2 framework other than Cobalt Strike that lacks BOF support
• you need a standalone GUI or general-purpose pentesting toolkit rather than beacon-integrated commands
• you are looking for defensive/blue-team tooling

Facets

library · maturity active

security cli developer-tools security penetration-testing developer-tools windows cli beacon-object-files cobalt-strike red-team offensive-security situational-awareness post-exploitation cna command-line

Member repositories

For agents

markdown · JSON · MCP: product_card(name="trustedsec/CS-Situational-Awareness-BOF")