Tradecraft Garden & Crystal Palace: The Cobalt Strike Creator's New Evasion Framework

Raphael Mudge, the creator of Cobalt Strike who stepped away from the industry in 2021, returned with open-source offensive research: Tradecraft Garden and the Crystal Palace linker.

Instead of keeping advanced tradecraft proprietary, this project publishes deep evasion mechanics openly for the security community.

🧩 Core Architecture: Tradecraft vs. Capability

Traditional offensive tools couple evasion techniques directly into payloads. Tradecraft Garden introduces a decoupled paradigm:

• Separation of Concerns: Evasion tradecraft is decoupled entirely from the core payload capability.
• Crystal Palace Linker: The underlying engine making this modular separation functional — handling:
  • Position-Independent Code (PIC) generation
  • Binary transformation & symbol obfuscation
  • Code and register randomization at link time
  • Dynamic import resolution and in-memory evasion primitives

🛡 Impact on Defensive Telemetry

When evasion tradecraft becomes composable and automated at link time, static signatures and rigid behavioral heuristics in EDRs struggle to keep pace. Blue teams must focus on kernel-level telemetry, call-stack spoofing detection, and behavioral telemetry at the subsystem boundary.

🔗 References:

• Tradecraft Garden: aff-wg.org
• Release announcement: Raphael Mudge Notes

For defensive telemetry research and authorized red teaming.