{"id":20068270,"url":"https://github.com/nickvourd/cs-aggressor-kit","last_synced_at":"2026-10-01T17:30:27.041Z","repository":{"id":227657242,"uuid":"769870677","full_name":"nickvourd/CS-Aggressor-Kit","owner":"nickvourd","description":"Homemade Aggressor scripts kit for Cobalt Strike","archived":false,"fork":false,"pushed_at":"2026-07-20T17:31:12.000Z","size":3100,"stargazers_count":106,"open_issues_count":0,"forks_count":21,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-09-27T08:24:12.418Z","etag":null,"topics":["aggressor-scripts","c2","c2-framework","cna","cobalt-strike","command-and-control","configuration","configuration-files","java","kit","redteam","redteam-infrastructure","redteam-tools","redteaming","weaponized"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nickvourd.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-03-10T09:54:45.000Z","updated_at":"2026-09-25T07:41:45.000Z","dependencies_parsed_at":null,"dependency_job_id":"18d8c99b-d451-4891-8481-ab5ffea836e9","html_url":"https://github.com/nickvourd/CS-Aggressor-Kit","commit_stats":null,"previous_names":["nickvourd/cs-aggressor-kit"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/nickvourd/CS-Aggressor-Kit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nickvourd%2FCS-Aggressor-Kit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nickvourd%2FCS-Aggressor-Kit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nickvourd%2FCS-Aggressor-Kit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nickvourd%2FCS-Aggressor-Kit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nickvourd","download_url":"https://codeload.github.com/nickvourd/CS-Aggressor-Kit/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nickvourd%2FCS-Aggressor-Kit/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":342085742,"owners_count":37906280,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-10-01T02:00:06.691Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aggressor-scripts","c2","c2-framework","cna","cobalt-strike","command-and-control","configuration","configuration-files","java","kit","redteam","redteam-infrastructure","redteam-tools","redteaming","weaponized"],"created_at":"2024-11-13T14:05:57.904Z","updated_at":"2026-10-01T17:30:27.034Z","avatar_url":"https://github.com/nickvourd.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# CS-Aggressor-Kit\n\nHomemade Aggressor scripts kit for Cobalt Strike\n\n\u003cp align=\"center\"\u003e\n  \u003cimg width=\"450\" height=\"450\" src=\"/Pictures/logo.png\"\u003e\u003cbr /\u003e\u003cbr /\u003e\n  \u003cimg alt=\"GitHub License\" src=\"https://img.shields.io/github/license/nickvourd/CS-Aggressor-Kit?style=social\u0026logo=GitHub\u0026logoColor=purple\"\u003e\n  \u003cimg alt=\"GitHub Repo stars\" src=\"https://img.shields.io/github/stars/nickvourd/CS-Aggressor-Kit?logoColor=yellow\"\u003e\u003cbr /\u003e\n  \u003cimg alt=\"GitHub forks\" src=\"https://img.shields.io/github/forks/nickvourd/CS-Aggressor-Kit?logoColor=red\"\u003e\n  \u003cimg alt=\"GitHub watchers\" src=\"https://img.shields.io/github/watchers/nickvourd/CS-Aggressor-Kit?logoColor=blue\"\u003e\n  \u003cimg alt=\"GitHub contributors\" src=\"https://img.shields.io/github/contributors/nickvourd/CS-Aggressor-Kit?style=social\u0026logo=GitHub\u0026logoColor=green\"\u003e\n\u003c/p\u003e\n\n## Description\n\nThis repository contains numerous CNA files (Aggressor Scripts) for Cobalt Strike, which are useful during a Red Team engagement.\n\nThis project created with ❤️ by [@nickvourd](https://x.com/nickvourd).\n\nSpecial thanks to [Will Nowlan](https://www.linkedin.com/in/will-nowlan-87b18a1bb/) for all his contributions.\n\nℹ️ This tool has been selected and it is proudly part of the [Cobalt Strike Community Kit](https://cobalt-strike.github.io/community_kit/).\n\n## Table of Contents\n- [CS-Aggressor-Kit](#cs-aggressor-kit)\n  - [Description](#description)\n  - [Table of Contents](#table-of-contents)\n  - [Summary](#summary)\n  - [Alert](#alert)\n    - [Setup Slack and Webhooks](#setup-slack-and-webhooks)\n    - [Setup Discord and Webhooks](#setup-discord-and-webhooks)\n    - [Setup Teams Webhooks](#setup-teams-webhooks)\n    - [Setup Mattermost Webhooks](#setup-mattermost-webhooks)\n    - [Set Up iMessage Implementation](#set-up-imessage-implementation)\n    - [Set Up Signal Implementation](#set-up-signal-implementation)\n    - [Set up Telegram Implementation](#setup-telegram-implementation)\n    - [Alert CNA Output Examples](#alert-cna-output-examples)\n      - [New incoming Beacon notification example (Slack)](#new-incoming-beacon-notification-example-slack)\n      - [New Web hit notification example (Discord)](#new-web-hit-notification-example-discord)\n      - [New CS client connects to the teamserver notification example (Slack)](#new-cs-client-connects-to-the-teamserver-notification-example-slack)\n      - [CS Client disconnects from the teamserver notification example (Discord)](#cs-client-disconnects-from-the-teamserver-notification-example-discord)\n      - [CS Client hosts a file or clones a website notification example (Slack)](#cs-client-hosts-a-file-or-clones-a-website-notification-example-slack)\n      - [CS client posts something in the event log (Discord)](#cs-client-posts-something-in-the-event-log-discord)\n      - [New credentials come in from keylogging (Discord)](#new-credentials-come-in-from-keylogging-discord)\n      - [New screenshot is taken from Cobalt Strike (Slack)](#new-screenshot-is-taken-from-cobalt-strike-slack)\n  - [Auto](#auto)\n    - [How Auto Sleep Works](#how-auto-sleep-works)\n    - [Auto Sleep Interactive For Testing](#auto-sleep-interactive-for-testing)\n    - [Auto Sleep After Initial Access](#auto-sleep-after-initial-access)\n  - [Misc](#misc)\n    - [Beacon Name Tab Example](#beacon-name-tab-example)\n    - [Beacon Name Tab Colors Example](#beacon-name-tab-colors-example)\n    - [CS All Tabs Bold Example](#cs-all-tabs-bold-example)\n    - [CWD Beacon Bar Example](#cwd-beacon-bar-example)\n    - [Opsec Example](#opsec-example)\n  - [SA](#sa)\n    - [File Color Example](#file-color-example)\n    - [Process Color Example](#process-color-example)\n  - [Utils](#utils)\n    - [Sonata Examples](#sonata-examples)\n      - [Sonata File](#sonata-file)\n      - [Sonata String](#sonata-string)\n    - [Locate Example](#locate-example)\n\n## Summary\n\nThe following table illustrates all the CNA files included in this project:\n\n| Section | Name | Description |\n|:-----------:|:-----------:|:-----------:|\n| Alert |[slack-alerts_linux.cna](/Alert/Slack/slack-alerts_linux.cna)| Slack CNA file for Linux CS client |\n| Alert |[slack-alerts_windows.cna](/Alert/Slack/slack-alerts_windows.cna)| Slack CNA file for Windows CS client |\n| Alert |[discord-alerts_linux.cna](/Alert/Discord/discord-alerts_linux.cna)| Discord CNA file for Linux CS Client |\n| Alert |[teams-alerts_linux.cna](/Alert/Teams/teams-alerts_linux.cna)| Teams CNA file for Linux CS Client |\n| Alert |[mattermost-alerts_linux.cna](/Alert/Mattermost/mattermost-alerts_linux.cna)| Mattermost CNA file for Linux CS Client |\n| Alert |[mattermost-alerts_windows.cna](/Alert/Mattermost/mattermost-alerts_windows.cna)| Mattermost CNA file for Windows CS Client |\n| Alert | [iMessage_MacOS.cna](/Alert/iMessage/iMessage_MacOS.cna) | iMessage CNA file for MacOS CS Client | \n| Alert | [Signal_linux.cna](/Alert/Signal/Signal_linux.cna) | Signal CNA file for Linux/MacOS CS Client | \n| Alert | [telegram-alerts_linux.cna](/Alert/Telegram/telegram-alerts_linux.cna) | Telegram CNA file for Linux/MacOS CS Client | \n| Auto | [auto-sleep-on-start.cna](/Auto/auto-sleep-on-start.cna) | This CNA file automatically sets the sleep time to a specific value when a new user joins the teamserver. It requires a client to remain open at all times, ensuring the sleep time is configured even if the Cobalt Strike client is closed or you forget to set it while away |\n| Auto | [auto-sleep-on-exit.cna](/Auto/auto-sleep-on-exit.cna) | This CNA file automatically sets the sleep time to a specific value when all users, except one, disconnect from the teamserver. A client must remain open at all times |\n| Auto | [auto-sleep-after-initial-access.cna](/Auto/auto-sleep-after-initial-access.cna) | This CNA file automatically configures the beacon's sleep interval upon initial acccess | \n| Auto | [auto-sleep-interactive-for-testing.cna](/Auto/auto-sleep-interactive-for-testing.cna) | This CNA file automatically set beacon sleep to 0 on initial connection |\n| Misc | [Beacon-Name-Tab.cna](/Misc/Beacon-Name-Tab.cna) | This CNA file modifies the Beacon tab name format from the default to `username`@`hostname` (`pid`) |\n| Misc | [Beacon-Name-Tab-Colors.cna](/Misc/Beacon-Name-Tab-Colors.cna) | This CNA file modifies the Beacon tab name format from the default to `username`@`hostname` (`pid`), for admin's beacon the color is red, for user's beacon the color is green |\n| Misc | [CS-All-Tabs-Bold.cna](/Misc/CS-All-Tabs-Bold.cna) | This CNA file makes all CS client tabs bold |\n| Misc | [CWD-Beacon-Bar.cna](/Misc/CWD-Beacon-Bar.cna) | This CNA file enhances Beacon console status bar to display the Beacon's last known working directory path. Additionally, improves the 'cd' command to support restoring the previous directory path seamlessly (Usage: `cd -`) |\n| Misc | [Opsec.cna](/Misc/Opsec.cna) | This CNA file allows and blocks default Cobalt Strike commands to improve the opsec. |\n| SA | [File-Color.cna](/SA/File-Color.cna) | This CNA file outputs files in a colorful format for file hunting |\n| SA | [PS-Color.cna](/SA/PS-Color.cna) | This CNA file outputs proccess in a colorful format for process hunting |\n| Utils | [Sonata.cna](/Utils/Sonata.cna) | Sonata is a file hash calculator that supports MD5, SHA1, SHA256, and SHA512 algorithms. The CNA port enhances functionality by supporting string hash calculations as well |\n| Utils | [locate.cna](/Utils/locate.cna) | This CNA functions like the `locate` Linux command. Additionally, it performs case-insensitive keyword searches. This CNA requires a Linux CS client |\n\n## Alert\n\nThese CNA files will notify you via the `Slack`/`Discord`/`Teams`/`Mattermost`/`Signal`/`iMessage`/`Telegram` applications when:\n\n- A new client connects to the team server.\n- A CS client disconnects from the team server.\n- A new incoming beacon.\n- A new web hit occurs.\n- A CS client posts something in the event log.\n- New site hosts.\n- New credentials come in from keylogging.\n- A new screenshot is taken from Cobalt Strike.\n\n:information_source: Some CNA files are compatible with Windows/Linux/MacOS operating systems.\n\nThe following table illustrates the CNA files included in the Alert section:\n\n| Name | OS | App | Description |\n|:-----------:|:-----------:|:-----------:|:-----------:|\n|[slack-alerts_linux.cna](/Alert/Slack/slack-alerts_linux.cna)| MacOS/Linux | Slack | Slack CNA file for Linux CS client |\n|[slack-alerts_windows.cna](/Alert/Slack/slack-alerts_windows.cna)| Windows | Slack | Slack CNA file for Windows CS client |\n|[discord-alerts_linux.cna](/Alert/Discord/discord-alerts_linux.cna)| MacOS/Linux | Discord | Discord CNA file for Linux CS Client |\n|[teams-alerts_linux.cna](/Alert/Teams/teams-alerts_linux.cna)| MacOS/Linux | Teams | Teams CNA file for Linux CS Client |\n|[mattermost-alerts_linux.cna](/Alert/Mattermost/mattermost-alerts_linux.cna)| MacOS/Linux | Mattermost | Mattermost CNA file for Linux CS Client |\n|[mattermost-alerts_windows.cna](/Alert/Mattermost/mattermost-alerts_windows.cna)| Windows | Mattermost | Mattermost CNA file for Windows CS Client |\n| [iMessage_MacOS.cna](/Alert/iMessage/iMessage_MacOS.cna) | MacOS | Apple iMessage | iMessage CNA file for MacOS CS Client | \n| [Signal_linux.cna](/Alert/Signal/Signal_linux.cna) | MacOS/Linux | Signal | Signal CNA file for Linux/MacOS CS Client | \n| [telegram-alerts_linux.cna](/Alert/Telegram/telegram-alerts_linux.cna) | MacOS/Linux | Telegram | Telegram CNA file for Linux/MacOS CS Client |\n\n### Setup Slack and Webhooks\n\n:information_source: To set up a Slack server and webhook, you can follow these guides provided on the [Slack website](https://api.slack.com/incoming-webhooks).\n\n### Setup Discord and Webhooks\n\n:information_source: To set up a Discord server and webhook, you can follow these guides provided on the [Discord website](https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks).\n\n### Setup Teams Webhooks\n\n:information_source: To set up a Microsoft Teams webhook, you can follow these guides provided on [Microsoft website](https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook?tabs=newteams%2Cdotnet).\n\n### Setup Mattermost Webhooks\n\n:information_source: To set up a Mattermost webhook, you can follow these guides provided on [Mattermost website](https://developers.mattermost.com/integrate/webhooks/incoming/).\n\n### Set Up iMessage Implementation\n\n:information_source: To set up the iMessage implementation, you need to use a device with MacOS like Macbook Pro/Air or Mac mini. \n\n- Install:\n\n```\nbrew install osascript\n```\n\n### Set Up Signal Implementation\n\n-\u003e Full Digram Communication:\n\n```\n+------------------------------+\n| Linux Host                   |\n|                              |\n|  Cobalt Strike / CNA Script  |\n|        (runs as root)        |\n|               |              |\n|     curl http://127.0.0.1:8080\n|               |              |\n+---------------|--------------+\n                |\n    Host port 8080 mapped to container port 8080\n                |\n+---------------v--------------+\n| Docker Container (signal)    |\n|  Process user: signal-api    |\n|  signal-cli REST API (8080)  |\n+------------------------------+\n```\n\n:information_source: In order to set up signal implementation, you need to do the following.\n\n- Install [Docker Desktop](https://docs.docker.com/desktop/)\n- Install docker signal-cli:\n\n```\ndocker run -d \\\n  --name signal \\\n  -p 8080:8080 \\\n  -v signal-data:/home/.local/share/signal-cli \\\n  bbernhard/signal-cli-rest-api\n```\n\n- Then connect:\n\n```\ndocker exec -it signal bash   \n```\n\n- Visit [Captcha Website](https://signalcaptchas.org/registration/generate.html)\n- Solve the captcha and you will see the following:\n\n![signal-token](/Pictures/signal-token.png)\n\n![signal-token-2](/Pictures/signal-token-2.png)\n\n- Switch to user:\n\n```\nsu - signal-api\n```\n\n- Register your number:\n\n```\nsignal-cli --config /home/.local/share/signal-cli -u \u003c+your_number\u003e register --captcha 'signalcaptcha://\u003cLONG_TOKEN_VALUE\u003e'\n```\n\n- Verify the number using the SMS code:\n\n```\nsignal-cli --config /home/.local/share/signal-cli -u \u003c+your_number\u003e verify \u003cverify_code\u003e\n```\n\n- Then set your profile name:\n\n```\nsignal-cli --config /home/.local/share/signal-cli -u \u003c+your_number\u003e updateProfile --name '\u003cC2_BOT_NAME\u003e' --about '\u003cDescription\u003e'\n```\n\n- From outside the container send a test message:\n\n```\ncurl -X POST http://127.0.0.1:8080/v2/send \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"number\": \"\u003c+your_number\u003e\",\n    \"recipients\": [\"\u003c+receipt_number\u003e\"],\n    \"message\": \"Test from Signal CLI REST API\"\n  }'\n```\n\n### Setup Telegram Implementation\n\n:information_source: To set up the Telegram notifications, you need to create a [new bot](https://core.telegram.org/bots/tutorial), you can follow these guides provided on [Telegram website](https://core.telegram.org/bots/api).\n\n### Alert CNA Output Examples\n\n#### New incoming Beacon notification example (Slack):\n\n![New-Beacon-Example](/Pictures/New-Beacon-Example1.png)\n\n#### New Web hit notification example (Discord):\n\n![Web-Hit-Example](/Pictures/Web-Hit-Example1.png)\n\n#### New CS client connects to the teamserver notification example (Slack):\n\n![New-CS-Client-Connect-Example](/Pictures/New-CS-Client-Connect-Example1.png)\n\n#### CS Client disconnects from the teamserver notification example (Discord):\n\n![CS-Client-Disconnect](/Pictures/CS-Client-Disconnect.png)\n\n#### CS Client hosts a file or clones a website notification example (Slack):\n\n![Host-File-Clone-Site](/Pictures/Host-File-Clone-Site.png)\n\n#### CS client posts something in the event log (Discord):\n\n![New-message-CS](/Pictures/New-message-CS.png)\n\n#### New credentials come in from keylogging (Discord):\n\n![New-credentials-come-in](/Pictures/Keystrokes-Received.png)\n\n#### New screenshot is taken from Cobalt Strike (Slack):\n\n![New-Screesnhot-taken](/Pictures/New-Screesnhot-taken.png)\n\n## Auto\n\nThese CNA files automatically configure certain actions in Cobalt Strike.\n\nThe following table illustrates the CNA files included in the Auto section:\n\n| Name | Description |\n|:-----------:|:-----------:|\n| [auto-sleep-on-start.cna](/Auto/auto-sleep-on-start.cna) | This CNA file automatically sets the sleep time to a specific value when a new user joins the teamserver. It requires a client to remain open at all times |\n| [auto-sleep-on-exit.cna](/Auto/auto-sleep-on-exit.cna) | This CNA file automatically sets the sleep time to a specific value when all users, except one, disconnect from the teamserver. A client must remain open at all times |\n| [auto-sleep-interactive-for-testing.cna](/Auto/auto-sleep-interactive-for-testing.cna) | This CNA file automatically set beacon sleep to 0 on initial connection |\n| [auto-sleep-after-initial-access.cna](/Auto/auto-sleep-after-initial-access.cna) | This CNA file automatically configures the beacon's sleep interval upon initial acccess |\n\n### How Auto Sleep Works\n\n:information_source: The two auto-sleep CNA files can be used individually or together, depending on your preferences.\n\n**Diagram 1**: The two Cobalt Srike clients are connected to the Team server.\n\n![Diagram-1](/Pictures/Diagram-1.png)\n\n**Diagram 2**: At the end of the day's engagement tasks, the operators decide to stop the engagement. One operator, using a Cobalt Strike client without the CNA file, disconnects from the teamserver, while the other operator ensures his/her Cobalt Strike client with the CNA file ([auto-sleep-on-exit.cna](/Auto/auto-sleep-on-exit.cna)) remains open.\n\n![Diagram-2](/Pictures/Diagram-2.png)\n\n**Diagram 3**: The Cobalt Strike client with the CNA file will detect the user disconnection event and automatically adjust the sleep time to the predefined value specified in the CNA file.\n\n![Diagram-3](/Pictures/Diagram-3.png)\n\n**Diagram 4**: The next day, when the operator (with the Cobalt Strike client without the CNA file) connects to the Team Server, the always-open client with the loaded CNA file ([auto-sleep-on-start.cna](/Auto/auto-sleep-on-start.cna)) will detect the new user connection. It will then automatically set the sleep time to the predefined value specified in the CNA file.\n\n![Diagram-4](/Pictures/Diagram-4.png)\n\n### Auto Sleep Interactive For Testing\n\nThis CNA file automatically sets the beacon sleep interval to 0 upon initial connection, which is useful for testing purposes.\n\n![Auto-Sleep-Interactive-Example](/Pictures/Auto-Sleep-Interactive-Example.png)\n\n### Auto Sleep After Initial Access\n\nThis CNA file automatically configures the beacon's sleep interval upon initial acccess.\n\n## Misc\n\nThese CNA files will configure the output format for various default functionalities of Cobalt Strike.\n\nThe following table illustrates the CNA files included in the Misc section:\n\n| Name | Description |\n|:-----------:|:-----------:|\n| [Beacon-Name-Tab.cna](/Misc/Beacon-Name-Tab.cna) | This CNA file modifies the Beacon tab name format from the default to `username`@`hostname` (`pid`) |\n| [Beacon-Name-Tab-Colors.cna](/Misc/Beacon-Name-Tab-Colors.cna) | This CNA file modifies the Beacon tab name format from the default to `username`@`hostname` (`pid`), for admin's beacon the color is red, for user's beacon the color is green |\n| [CS-All-Tabs-Bold.cna](/Misc/CS-All-Tabs-Bold.cna) | This CNA file makes all CS client tabs bold |\n| [CWD-Beacon-Bar.cna](/Misc/CWD-Beacon-Bar.cna) | This CNA file enhances Beacon console status bar to display the Beacon's last known working directory path. Additionally, improves the 'cd' command to support restoring the previous directory path seamlessly (Usage: `cd -`) |\n\n### Beacon Name Tab Example\n\nThis CNA file modifies the Beacon tab name format from the default to `username`@`hostname` (`pid`).\n\n![Beacon-Tab-Name-Example](/Pictures/Beacon-Tab-Name-Example.png)\n\n### Beacon Name Tab Colors Example\n\nThis CNA file modifies the Beacon tab name format from the default to `username`@`hostname` (`pid`). For an Administrator's Beacon, the tab color is set to red, while for a standard user's Beacon, the tab color is set to green.\n\n![Beacon-Tab-Name-Colors-Example](/Pictures/Beacon-Tab-Name-Colors-Example.png)\n\n### CS All Tabs Bold Example\n\nThis CNA file makes all Cobalt Strike client tabs bold.\n\n![CS-All-Tabs-Bold-Example](/Pictures/CS-All-Tabs-Bold-Example.png)\n\n### CWD Beacon Bar Example\n\nThis CNA file enhances Beacon console status bar to display the Beacon's last known working directory path.\n\n![CWD-Beacon-Bar-Example](/Pictures/CWD-Beacon-Bar-Example.png)\n\nAdditionally, improves the 'cd' command to support restoring the previous directory path seamlessly (Usage: `cd -`).\n\n![CWD-Beacon-Bar-Example-2](/Pictures/CWD-Beacon-Bar-Example-2.png)\n\nFinally, when you have an Administrator's Beacon, the hostname of the target machine changes from the CNA's default green (used for standard users) to red.\n\n![CWD-Beacon-Bar-Example-Admin](/Pictures/CWD-Beacon-Bar-Example-Admin.png)\n\n### Opsec Example\n\nThis CNA file allows and blocks default Cobalt Strike commands to improve the opsec.\n\n## SA\n\nThese CNA files are used for Situational Awareness.\n\nThe following table illustrates the CNA files included in the SA section:\n\n| Name | Description |\n|:-----------:|:-----------:|\n| [File-Color.cna](/SA/File-Color.cna) | This CNA file outputs files in a colorful format for file hunting |\n| [PS-Color.cna](/SA/PS-Color.cna) | This CNA file outputs proccess in a colorful format for process hunting |\n\n## File Color Example\n\nThis CNA file outputs files in a colorful format for file hunting.\n\n- [*] Executable files listed in GREEN  \n- [*] System-Related files listed in PURPLE  \n- [*] Database files listed in YELLOW  \n- [*] Office related files listed in RED  \n- [*] Source Code files listed in CYAN\n- [*] Media files listed in ORANGE\n- [*] Directories listed in BLUE\n\n![File-Color-Example](/Pictures/File-Color-Example.png)\n\n## Process Color Example\n\nThis CNA file outputs proccess in a colorful format for process hunting.\n\n- [*] This Beacon PID: YELLOW (\u003cbeacon_pid\u003e) \n- [*] Windows Processes: GREEN  \n- [*] Security Products: RED  \n\n![Process-Color-Example](/Pictures/Process-Color-Example.png)\n\n## Utils\n\nThese CNA files are used for general micro tasks during operations.\n\nThe following table illustrates the CNA files included in the Utils section:\n\n| Name | Description |\n|:-----------:|:-----------:|\n| [Sonata.cna](/Utils/Sonata.cna) | This CNA file is a port of the [Sonata](https://github.com/nickvourd/Sonata) tool. Sonata is a file hash calculator that supports MD5, SHA1, SHA256, and SHA512 algorithms. The CNA port enhances functionality by supporting string hash calculations as well |\n| [locate.cna](/Utils/locate.cna) | This CNA functions like the `locate` Linux command. Additionally, it performs case-insensitive keyword searches. This CNA requires a Linux CS client |\n\n### Sonata Examples\n\nHash calculator for local files and strings.\n\nUsage: `Sonata -f/--file \u003clocal_filepath\u003e OR Sonata -s/--string \u003cstring\u003e`\n\n#### Sonata File \n\n![Sonata-Example-1](/Pictures/Sonata-Example-1.png)\n\n#### Sonata String\n\n![Sonata-Example-2](/Pictures/Sonata-Example-2.png)\n\n### Locate Example\n\nThis CNA functions like the `locate` Linux command. Additionally, it performs case-insensitive keyword searches. This CNA requires a Linux CS client.\n\nℹ️ When you insert a new file on the host disk, it is recommended to run the `updatedb` command to update the file database and sync the system with the newly added files.\n\n![locate-example](/Pictures/locate-example.png)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnickvourd%2Fcs-aggressor-kit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnickvourd%2Fcs-aggressor-kit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnickvourd%2Fcs-aggressor-kit/lists"}