Modern Defenses and YOU!

This post outlines modern evasion and OPSEC techniques for Cobalt Strike operations: choose plausible host processes and infrastructure (e.g., aged, categorized domains, domain fronting), minimize risky child processes via session prepping (ppid spoofing, spawnto), avoid remote process injection and PowerShell in favor of API-driven actions and .NET assemblies, and improve in-memory stealth by using stageless/x64 payloads, Malleable PE options, non-RWX pages, and legitimate code-signing. It emphasizes adapting tradecraft to defender telemetry and heuristics to blend with normal activity.