I hope Fortra legal don't come after me for this one. I just couldn't resist.

Cobalt Strike 4.12 is LIVE, complete with a new look for the GUI! Additionally, we're introducing: - A REST API - User Defined Command and Control (UDC2) - New process injection options - New UAC bypasses - and more! Check out the release blog for more details. https://ow.ly/e61m50Xx1OU

🔥 #BlackFriday discounts are live🔥 ➤ 35% OFF all #KQL courses for threat hunting, detection engineering, and incident response. #ThreatHunting #DetectionEngineering #DFIR #incidentresponse #CyberSecurity #InfoSec 👉academy.bluraven.io/blackfriday2...

[BLOG] PICing AOP - a summary of the latest Crystal Palace commands for Aspect-Oriented Programming. rastamouse.me/picing-aop/

Cobalt Strike 4.12 is nearly here! Join us at the release party demo to look at the new release, including a modernized GUI, a REST API for research and automation, new process injection options, and more! See you on Nov. 18! https://ow.ly/WOro50Xqg5M

Jumping on the bandwagon

If only I could predict the lottery with as much accuracy. Lots of new commands to dig into but looking forward to it!

Tradecraft Engineering with Aspect-Oriented Programming @rastamouse.me pretty much predicted what was coming in his last blog post. attach (Win32 APIs), redirect (local funcs), capability right-sized IAT hooks, and PICO function exports. Yes, attach can incept its PIC. aff-wg.org/2025/11/10/t...

I love seeing all these libraries come together

LibWinHttp is a simplified WinHTTP wrapper designed as a Crystal Palace shared library for implant development. Its primary purpose is to facilitate the development of PICO modules that require HTTP/HTTPS transport layer communication. github.com/pard0p/LibWi...

LibIPC is a simple Crystal Palace shared library for inter-process communication, based on Named Pipes. github.com/pard0p/LibIPC

As new projects, blog posts, and other efforts around TCG show up, I'm listing them here: tradecraftgarden.org/references.h... I've put together a Friends of the Tradecraft Garden list on BlueSky too: bsky.app/profile/did:... Thank you for building, exploring, & teaching w/ this young project 🪴

LibGate - a Crystal Palace shared library for resolving and performing syscalls github.com/rasta-mouse/...

Quick blog post that explores some of the problems (that I had) that this update has helped solve, and where I see it potentially going in the future. rastamouse.me/arranging-th...

Tradecraft Garden’s PIC Parterre Dynamic Function Resolution pt. 2, Say yes to the .bss, and symbol remapping. aff-wg.org/2025/10/27/t...

I had this idea for a portal tailored to PIC analysis, where you upload either a .bin or the disassembly output and receive an automated analysis of its tradecraft, with an LLM to ask specific questions.

Did you know that Crystal Palace can merge multiple COFFs straight into a single PIC blob? It means we can produce complete PIC programs from modular parts, without needing a dedicated loader. Plus access to DFR and shared libraries... just lovely.

I found it far more enjoyable doing string replacements in Aggressor than in the C2 profile because the feedback loop is so much quicker - no need to stop/start the server after every change.

Classic headline. Most of the article and the podcasty recording don't beat on him so much, thankfully.

Took me long enough, but finally managed to hook into mscoreei.dll and stack spoof load library calls for clr.dll.

LibCPLTest: A shared library for Crystal Palace that allows you to unit test your PICOs. It's nothing too fancy, just a few helper functions and a macro, but it's helped me to create a consistent framework for testing my PIC capabilities. github.com/ofasgard/Lib...

Found a pretty funny problem with detouring GetProcAddress -it breaks smartinject because it passes invalid pointers to the loader.

I want to point out a few things happening with this fledgling Tradecraft Garden ecosystem. Right now things. But, how I see them in context of the overall model this could become.

And it's released! 🎉 github.com/ofasgard/exe... I've tested it with Rubeus and Seatbelt and a variety of different arguments, and it seems to be pretty stable as far as I can tell. If anyone uses this PICO and encounters bugs or instability, please let me know!

Crystal Kit is just too powerful.

Why plant a Tradecraft Garden? April 2025, I talked to my camera about how tradecraft may go the route we saw vuln research go years ago, red teaming's retreat to self-protective secrecy, and the opportunity I see for a public tradecraft ecosystem. This starts @ 1:16:00 vimeo.com/1074106659#t...

The new Crystal Palace version is very cool. Having DFR in your PIC code and just providing a resolver function is so much more ergonomic than having two different mechanisms for resolving APIs! I love it - already updated my HWB PICO to incorporate the new functionality.

My first Crystal Palace shared library! github.com/rasta-mouse/...

Very cool feature sets! It's already time to rewrite my evasion kit 😅

Weeding the Tradecraft Garden aff-wg.org/2025/10/13/w... Dynamic Function Resolution for PIC(?!?), rewriting x86 PIC to fix pointers, and a shared library concept for PICOs/PIC

[Crystal Kit] Evasion kit for Cobalt Strike. github.com/rasta-mouse/...

Working on a fun Crystal Palace loader that hooks APIs and pushes them through a call stack spoofing PICO.

I can't really wrap my head around it tbh. I find it totally far-fetched that they didn't know this issue existed, and bitching that "MS didn't tell us about it" is deflecting their own negligence.

I do think that Ascension and others that get roasted like this do need to take some accountability though. I'd be willing to bet Kerberoasting was raised in one if not multiple pentest reports prior to the breach, but they chose not to do anything about it.

Analysis of a Ransomware Breach aff-wg.org/2025/09/26/a... Breach analysis? Breach intelligence? Industry critique? Fee-only ransomware negotiator? 100% efficacy? The story of how Microsoft worked an old problem, fucked it up, we malign the guy who told us, they fixed it, and it wasn't fixed? PtH?

[BLOG] I wrote a short post on using the Crystal Palace API from an external Java program. rastamouse.me/crystal-pala...

I learned some Java @raphaelmudge.bsky.social !! 😅

Quick post on how to use the new make coff and merge commands in @raphaelmudge.bsky.social's Crystal Palace. rastamouse.me/modular-pic-...

Playing with @raphaelmudge.bsky.social's latest CP update (it's very cool). I have mixed feelings about merging COFFs though. It simplifies overall development and gives the loader fewer jobs to do, but on the other hand you lose some flexibility about where each "part" goes in memory.

Very cool!

If you're in London, Will Burgess (x.com/joehowwolf) is speaking at Beacon %25 on "Linkers and Loaders: Experiments with Crystal Palace" this Thursday. www.eventbrite.co.uk/e/beacon-25-... beac0n.org From his X: "If you enjoy filthy PIC tradecraft it may be of interest!"

During my #BHUSA talk I've released many ETW research tools, of which the most notable is BamboozlEDR. This tool allows you to inject events into ETW, allowing you to generate fake alerts and blind EDRs. github.com/olafhartong/... Slides available here: github.com/olafhartong/...

It's been almost a year since my last blog... So, here is a new one: Extending AD CS attack surface to the cloud with Intune certificates. Also includes ESC1 over Intune (in some cases). dirkjanm.io/extending-ad... Oh, and a new tool for SCEP: github.com/dirkjanm/sce...

Published a small collection of PIC loaders for Cobalt Strike, based on my experiments with Crystal Palace. github.com/rasta-mouse/...

[BLOG] Here's the post - I demonstrate my QoL improvements for working with the TCG codebase. This includes vscode with intellisense support, and producing debug builds for use in WinDbg. rastamouse.me/debugging-th...

I think I've got a nice way to produce debug builds for Crystal Palace loaders. It produces an EXE that works with WinDbg so you can debug against the source code, with locals, etc.

I adapted Crystal Palace's hooking loader to hook arbitrary CS BOFs, and obfuscate both Beacon and the BOF when making Win32 API calls. One caveat that I ran into was the need to copy arguments that are passed in as pointers. Other than that, it seemed to work ok.

[BLOG] My thoughts (and code examples) for writing modular PIC C2 agents. rastamouse.me/modular-pic-...

@raphaelmudge.bsky.social I read your entire CrystalPalace src code with the intention of porting it to a C# library (CrystalPalace.NET). Just wanted to tip my hat, as there are certainly some non-trivial things happening under the hood to make all this work :D

Thanks to this excellent video, we now have a new emoji in the ZPS Discord server, the :sadmudge:. Seriously, this is a good video for getting started with PIC dev and cleared up quite a few things for me.