🎭 BOFMask

BOFMask is a tool designed to conceal Cobalt Strike's Beacon payload while executing a Beacon Object File (BOF). By applying a XOR mask and modifying memory protection settings, BOFMask enables users to execute BOFs without exposing Beacon, thereby avoiding detection by EDR products that scan system memory.

Research:
https://securityintelligence.com/posts/how-to-hide-beacon-during-bof-execution/

Source:
https://github.com/xforcered/bofmask

#cobaltstrike #bof #sleepmask #redteam