DropSpawn

DropSpawn is a Cobalt Strike Beacon Object File that spawns an additional Beacon through DLL application-directory hijacking, as an alternative to conventional process injection. It spoofs the executable's application directory so a generated proxy DLL is loaded from a caller-selected writable folder. The public repository includes a Python 3 generator and demonstration DLL; the operator must provide a payload DLL compatible with exports from the target machine's matching original DLL. Choose a suitable executable and payload architecture: missing exports or dependencies that remain only in the executable's original directory can make the child process fail. The README describes x86-to-x86, x64-to-x64, and cross-architecture use. No published release is listed.