C2-agnostic BOF collection, categorized by attack chain phase. Designed to be small and modular, allowing for quick execution and automation.
A C2-agnostic collection of Beacon Object Files (BOFs) for red team and offensive security operations. BOFs are organized by attack chain phase and designed to be small, modular, and automation-friendly for use in reconnaissance, enumeration, and post-exploitation workflows.
| BOF | Use |
|---|---|
| ai_surface | Maps AI tooling on Windows developer endpoints and highlights their configuration artifacts that may expose server definitions, commands, arguments, and embedded credentials. |
| clipboard_grab | Retrieves text data from the Windows clipboard using Win32 APIs and returns the contents to the callback. Original Code Credits: @rvrsh3ll |
| ide_extension_surface | Enumerates VS Code, Cursor, Windsurf, Zed, Insiders, OSS, and server/remote extension manifests from per-user profile roots and summarizes extension identity, activation events, and capability signals. |
| powershell_history | Collects PowerShell history artifacts from default PSReadLine and transcript locations. Useful for locating credentials or infrastructure. |
| window_handles_enum | Enumerates window handles across all system processes and uses a legitimate window handle to access the clipboard. |
DISCLAIMER: The creators and contributors of this repository accept no liability for any loss, damage, or consequences resulting from the use of the information or code contained in this repo. By utilizing this repo, you acknowledge and accept full responsibility for your actions. Use at your own risk.
| BOF | Use |
|---|
| notepad_grab | Extracts and returns plain text directly from open Notepad windows by reading memory, allowing operators to recover unsaved or in-memory notes. Useful for data collection from live endpoints. Original Source: NoteThief |
| schtask_enum | Enumerates scheduled tasks on Windows systems using the Task Scheduler COM interface. Provides a summary of tasks including their state, schedule, and configuration without overwhelming the beacon with XML data. Original Source: TrustedSec CS-Situational-Awareness-BOF |
| net_use | Add, list, or remove mapped drives via MPR (Modernized to manage memory properly, avoiding crashing) Original Source: TrustedSec CS-Situational-Awareness-BOF |
| session_view | Enumerates Windows Terminal Services sessions, displaying session IDs, usernames, domains, connection states, and session LUIDs. Original Source: SessionView by lsecqt |
| BOF | Use |
|---|
| certstore_loot | Enumerates local certificate stores to find certificates with exportable private keys and provides you with the path to export them. |
| cloud_metadata_check | Probes cloud-local metadata services for AWS, Azure, and GCP from the current process, reporting provider identity, instance context, and bounded credential snippets when reachable. |
| process_tokens_list | Enumerates accessible tokens from running processes, showing user context, token type (primary/impersonation), and impersonation level. Supports optional filtering by PID or process name. SeDebugPrivilege is disabled by default for OPSEC. |
| BOF | Use |
|---|
| amsi_etw_detect | Checks for AMSI and ETW presence in the current process by detecting loaded DLLs and ETW-related exports. Useful for picking targets with less security activity when applied broadly. |
| app_count | Counts the number of installed applications via the registry, de-duplicates, and prints. Applied to a large number of beacons, allows us to infer things about a device based on app count differences. |
| applocker_policy | Enumerates AppLocker policy configurations, rule collections, and enforcement modes by scanning the relevant registry keys. |
| asr_status | Enumerates Windows Defender Attack Surface Reduction (ASR) rules from registry locations to identify which ASR rules are configured, their enforcement state (Block/Audit/Warn/Disabled), and the policy source (Intune/MDM vs Group Policy). |
| bitlocker_status | Enumerates BitLocker encryption status, policy configurations, and recovery key backup locations by scanning registry keys. |
| mdm_policy_artifacts | Uses a scoring model to assess MDM enrollment posture on Windows systems by evaluating indicators including join state, scheduled tasks, policy configuration, and enrollment artifacts. |
| netjoin_query | Queries Windows domain join information and workstation details, identifying if the system is domain-joined or in a workgroup. |
| power_state | Identifies host form factor as Laptop, Desktop, Tablet, Server, Embedded, or Unknown using SMBIOS chassis data with a power-status fallback. |
| proxy_enum | Enumerates Windows proxy configuration state across WinINET, WinHTTP, policy keys, environment variables, WPAD indicators, Chrome settings, and .NET defaultProxy values. |
| tray_scout | Reports the taskbar host executable and enumerates system tray notification icon tooltips, with optional full image paths for the host and each icon's owning process. |
| user_idle | Gets user idle time since last input and GUI resource usage (GDI/USER handles) in the current process for timing intelligence. |
| wallpaper_enum | Enumerates the current desktop wallpaper path for each attached monitor using the modern IDesktopWallpaper COM interface. Centralized wallpapers are sometimes on internal SMB shares or imaging servers, revealing network paths, domain trusts, and policy enforcement without touching disk or the network. |
| wef_detect | Detects Windows Event Forwarding (WEF) configuration, which indicates centralized logging. If found, indicates security events are being forwarded to a central server. |
| window_list | Enumerates the titles of all visible windows on the current user's desktop, optionally including Process IDs (PIDs). |
| wsc_status | Queries Windows Security Center health status, including Anti-Virus, Firewall, Anti-Spyware, WSC Service, Auto-Update, Internet Settings, and User Account Control. |
| win_version | This BOF queries the registry and system APIs to provide a concise but detailed overview of the Windows installation. |
| BOF | Use |
|---|
| com_probe | Probe whether a COM object can be instantiated from a given CLSID. |
| firewall_rule | Add, remove, or query Windows Firewall rules via the COM API (INetFwPolicy2) without spawning netsh.exe or cmd.exe. Useful for pivoting inside networks. |
| port_scan | Scans a single IPv4 host for open TCP and/or UDP ports via Winsock with bounded port lists, configurable timeouts, and concise open-port output. |
| service_control | Manages local Windows services via SCM: query (capped list or single service), create, start, stop, delete, and configure failure actions. Elevated rights usually required for changes. |
| wevt_logon_enum | Enumerates recent Security log (successful/failed) logon events (Event IDs 4624,4625,4672) via the wevtapi API and prints remote workstation name/IP plus the target username. |
