Rasta Mouse
Capabilities written to PICO conventions can be output as PIC, PICOs, or COFFs. These formats typically require some sort of 'runner' to inject them into memory - whether that's a shellcode runner, PICO runner, or COFF/BOF runner. There are several challenges with memory-injected content, including:
Intrinsics are functions used in code that are later replaced - typically with compiler-generated instructions. Examples of intrinsics include __movsb , which generates a rep movsb instruction; and __stosb , which generates a rep stosb instruction. Crystal Palace provides a handful of built-in intrinsics, such as __resolve_hook , __tag_x , and
Despite what some would lead you to believe, Crystal Kit is not, and was never intended to be, an all-encompassing nirvana of evasion tradecraft. It was a simple project to experiment with Crystal Palace (CPL) by applying evasion tradecraft to Cobalt Strike's Beacon. There are some capabilities
In a previous post, I wrote about BOF Cocktails - an execution pattern to merge tradecraft into postex BOFs so they didn't have to rely on an agent/loader for their evasion. That post outlines the problem areas more fully, so I encourage you to read that first. At
💡 This blog was originally posted on 26 May 2026 and subsequently updated on 04 June 2026. Module stomping (aka module overloading or DLL hollowing) is a technique for hiding malicious code within a process's memory. It essentially works by loading a legitimate DLL into memory and then
tl;dr Inspired by Red Canary's Atomic Red Team , 'Atomic BOFs' is my attempt at an implementation pattern to ease detection engineering for Beacon Object Files. GitHub - rasta-mouse/atomic-bofs: Atomic test units for BOF execution Atomic test units for BOF execution. Contribute to rasta-
The goal of Crystal Palace (and the Tradecraft Garden) is to separate evasion tradecraft from the capability. This means that a capability (such as a DLL) has no evasion built into it; and that evasion is weaved in at link-time in a manner that the capability is not aware
In my post Cracking the Crystal Palace , I explored several aspects of Crystal Palace that remain unchanged after +optimize and +mutate passes have been performed. These are "islands of invariance", or to put it another way, predicatable parts of Crystal Palace output that don't change, and
Crystal Palace is a PIC framework that can be used to write, among other things, prepended DLL loaders. The philosophy of the project is to apply evasion tradecraft (also written as PIC), to a capability at link-time. For a DLL, it does this by hooking the IAT and redirecting
Raffi just released another update to Crystal Palace, which serves to improve the way specification files are handled by making them more modular. Tradecraft Orchestration in the Garden What’s more relaxing than a beautiful fall day, a crisp breeze, a glass of Sangria, and music from the local
If you follow this blog, you'll know I've been posting about Crystal Palace a LOT recently, mostly from an attack perspective. Today, I thought I'd channel my blue-teamer alter ego and look at Crystal Palace from a defence perspective. That is, are there
The 11.10.25 Crystal Palace release added more new commands in one go than I think I've seen thus far. Many of them seemed really similar at first blush, and it took me a while to get an understanding of where each one is applicable (I failed
Raffi just released an update to Crystal Palace (CP), so I wanted to write about some of the problems that I think it helps solve for PIC development and where it may take us in the future. The philosophy of CP is to build evasion tradecraft as PIC that are
tl;dr - repo here . The Crystal Kit is an experimental project designed to replace Cobalt Strike's Sleepmask. The Sleepmask (and BeaconGate) are key to Beacon's runtime evasion strategy - not only does it mask Beacon's memory, it also acts as an API proxy for Beacon
Crystal Palace provides two command-line tools, called link and piclink , which are used with a specification file to combine a reflective loader with one or more capabilities (DLLs and/or COFFs). link takes the path to a spec file, the path to a DLL or COFF, and outputs PIC: