trustedsec/CS-Situational-Awareness-BOF
FreeSituational Awareness commands implemented using Beacon Object Files
FreeFree tier
About trustedsec/CS-Situational-Awareness-BOF
CS-Situational-Awareness-BOF is an open-source repository by TrustedSec that provides a collection of basic situational awareness commands implemented as Beacon Object Files (BOFs) for Cobalt Strike. It enables operators to perform host checks such as AD enumeration, ARP table listing, directory listing, LDAP searches, and more before executing more invasive commands. The project also serves as a code example and workflow reference for developing custom BOFs, accompanied by a detailed blog post from TrustedSec.
Key Features
Collection of basic situational awareness commands (adcs_enum, arp, dir, ldapsearch, etc.)
Implemented as Beacon Object Files (BOFs) for Cobalt Strike
Provides code examples and workflow for creating custom BOFs
Companion to TrustedSec blog post for developers
Commands cover AD enumeration, network mapping, process inspection, and more
Pros & Cons
Pros
- Free and open source with permissive license
- Provides non-invasive situational awareness checks for safer post-exploitation
- Serves as a practical learning resource for BOF development
- Backed by TrustedSec, a reputable cybersecurity company
- Wide range of commands covering various system and AD enumeration tasks
Cons
- Requires Cobalt Strike and a compatible BOF execution environment
- Limited to Windows systems and post-exploitation scenarios
- Not a standalone tool; dependent on the Cobalt Strike framework
- Custom BOF development has a learning curve for newcomers
Best For
Perform host reconnaissance before executing invasive commands in Cobalt StrikeEnumerate Active Directory certificates and templatesList ARP tables, directory contents, and environment variables on a targetSearch LDAP for objects and attributesCheck driver signatures against known AV/EDR vendorsRetrieve password policies and DPAPI system keys
FAQ
What is the purpose of this repository?
It provides a set of basic situational awareness commands as Beacon Object Files for Cobalt Strike, allowing operators to perform host checks before running more invasive commands. It also serves as a code example and workflow guide for creating custom BOFs.
How do I create a new BOF command using this repo?
Create a folder for the topic (e.g., SA), copy base_template into topic/commandname, modify the Makefile with the command name, and create a .cna file with the relevant commands using the readbof helper function from SA.cna.