research poc
BOFRyptor Encrypts Cobalt Strike Beacon During BOF Execution to Evade Memory ScannersBOFRyptor
BOFRyptor is a proof-of-concept BOF that encrypts the Cobalt Strike beacon code and configuration in memory during BOF execution to prevent detection by memory scanners. It was developed after discovering that Microsoft Defender for Endpoint triggers a memory scan during certain API calls, exposing the unencrypted beacon. The technique encrypts the beacon region and heap configuration at BOF start and decrypts them at BOF end.