外网露出：新版 CobaltStrike 顶级免杀套件Arsenal kit

简介

Arsenal kit是CobaltStrike官方同步开发更新的，给予CobaltStrike自定义payload模板能力的构筑工件，你可以通过修改Arsenal kit套件内部的模板代码，在其中加入自己的免杀对抗功能，从而实现原生的反病毒反EDR的能力。

Arsenal kit一般不单独出售，都是随着官方的CobaltStrike同步捆绑销售。

说明

此次露出的kit工具包内容概览：

这次泄露出来的工具包，hash对比与官网一致，但还是建议谨慎操作！

而且这个版本的套件已经支持了CobaltStrike 4.10，更多精彩的功能，看release notes即可：

Arsenal Kit Release Notes
(c) 2012-2024 Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective owners.
-------------

July 16, 2024 - Arsenal Kit
-------------
++ Artifact Kit
+ Updated the artifact stage_size to support 4.10 beacons.

++ Postex Kit
+ Added a new kit that can be used to create your own long-running postex tasks.

++ Sleep Mask Kit
+ Added new sleep mask source code example to work with the 4.10 release
+ Added new sleep mask system call method 'beacon' which retrieves system call information from beacon.
+ Updated the directory names for the sleep mask code support.
  sleepmask/src will support the current release (4.10)
  sleepmask/src49 will support 4.9.x only
  sleepmask/src47 will support 4.7.x and 4.8.x only

++ User Defined Reflective Loader for Visual Studio (UDRL-VS) Kit
+ Updated examples to work with the 4.10 release
+ Updated the bud-loader and obfuscation-loader to populate and pass the ALLOCATED_MEMORY structure to Beacon
+ Updated the bud-loader to provide allocated memory for PURPOSE_BOF_MEMORY and PURPOSE_SLEEPMASK_MEMORY
+ Updated the bud-loader to support the CreateFile, ReadFile, and WriteFile system calls
......
......
.....