BOFMask

BOFMask is an unreleased C proof of concept published by IBM X-Force Red as a header for Cobalt Strike Beacon Object Files (BOFs). During BOF execution, its code locates Beacon memory with VirtualQuery and XOR-masks the located region, changing its protection to reduce signature-based scanner visibility in the authors' tests. It masks Beacon within its existing process and does not perform Extra Window Memory injection into another process. The authors document loader and call-order caveats and note that the executing BOF, plus an optional Sleep Mask BOF, may remain in unbacked RX/RWX regions.