“If you don't want to find lots of critical application vulnerabilities, don't put Bobby on your pentest team. He. Does. Not. Stop.”
About
Bobby Cooke is a Red Team Operator on the IBM X-Force Red Adversary Services team…
Activity
-
Module Stomping is a well-known technique, but as far as I’m aware—independent of any public PoCs—using it in the “classic” way will always…
Module Stomping is a well-known technique, but as far as I’m aware—independent of any public PoCs—using it in the “classic” way will always…
Liked by Bobby Cooke
-
Here's to that fateful day in 2017 when I purchased the best car I'd ever owned... Tesla Model X, you're what started it. Farewell, dear friend!
Here's to that fateful day in 2017 when I purchased the best car I'd ever owned... Tesla Model X, you're what started it. Farewell, dear friend!
Liked by Bobby Cooke
-
RE tip of the day: When you use rundll32.exe to debug a malicious DLL on a 64-bit system, use c:\windows\system32\rundll32.exe to debug 64-bit DLLs…
RE tip of the day: When you use rundll32.exe to debug a malicious DLL on a 64-bit system, use c:\windows\system32\rundll32.exe to debug 64-bit DLLs…
Liked by Bobby Cooke
Experience
Licenses & Certifications
Publications
Projects
-
BokuLoader : Cobalt Strike Reflective Loader
A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!
Other creatorsSee project -
Azure Outlook Command & Control (C2)
-
Azure Outlook Command & Control (C2) - Remotely control a compromised Windows Device from your Outlook mailbox. Threat Emulation Tool for North Korean APT InkySquid / ScarCruft / APT37.
TTP: Use Microsoft Graph API for C2 Operations.Other creatorsSee project -
Cobalt Strike BOF - Inject ETW Bypass
-
See projectCobaltStrike BOF - Inject ETW Bypass into Remote Process via Syscalls (HellsGate|HalosGate)
-
Cobalt Strike Community Kit
-
See projectContributor to the official Cobalt Strike Community Kit. Contributing multiple Beacon Object Files (BOFs) that extend the functionality of the Red Team Adversary Emulation Tool, Cobalt Strike.
-
Cobalt Strike User-Defined Reflective Loader
-
See projectCobalt Strike User-Defined Reflective Loader written in Assembly & C for advanced evasion capabilities.
-
HOLLOW (BOF)
-
See projectEarlyBird process hollowing technique (BOF) - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and execute shellcode
-
Inject AMSI Bypass (BOF)
-
See projectCobalt Strike Beacon Object File (BOF) that bypasses AMSI in a remote process with code injection.
-
SPAWN (BOF)
-
See projectCobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (ACG), BlockDll, and PPID spoofing.
Recommendations received
-
LinkedIn User
3 people have recommended Bobby
Join now to viewOther similar profiles
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top contentOthers named Bobby Cooke in United States
13 others named Bobby Cooke in United States are on LinkedIn
See others named Bobby Cooke