MacroPack
Generate Delivery-Ready Payloads. In Minutes.
MacroPack covers the entire initial access and assume breach payload pipeline for Windows environments. State of the arts attack methods and formats, built-in evasion for modern EDR, and native integration with every major C2 framework.
What MacroPack Does
MacroPack is a Swiss-army knife for initial vector generation. It helps Red Teams automate, weaponize and deliver payloads while offering robust defense bypass techniques. MacroPack handles everything, format selection, obfuscation, evasion technique application, social engineering mechanisms, and output.
The problem it solves is specific: red teams spend disproportionate time building and testing payloads before engagements. Evasion methods that worked last month may fail today. Formats that bypass one EDR get caught by another. MacroPack abstracts that iteration loop so operators can focus on scenario execution. MacroPack will help you for initial access hassle such as SmartScreen, and in assume breah scenario, MacroPack is useful to run tools in locked environment where most payloads are not allowed to run.
For TIBER-EU engagements specifically, where timelines are fixed and scenarios are intelligence-led, payload preparation time is not a variable that should eat into execution time. MacroPack handles it.
Features Overview
| Category | Features |
|---|---|
| Use Case | Initial Access, Assume Breach, Weaponize third party tooling |
| Payloads | LNK, ClickOnce, HTML/SVG smuggling, Office (Word, Excel, PowerPoint, Publisher, OneNote, Visio, Project), XLM macros, HTA, WSF, VBS, ISO/ZIP/7z/MSI containers, PDF, .vsix, .chm |
| EDR Evasion | Evade static and runtime detections. Tested in real operations against multiple EDRs and Antivirus. |
| Social Engineering | Add decoy, spoof extension, spoof icon, etc, Mark Of the Web evasion help |
| Payload Customization | Multiple methods to launch shellcodes, drop files, execute command line, etc , Guardrails (such as domain name, validy dates, etc), possibility to add custom code, different ways to run a payload |
| Platforms | GUI and CLI, tested on Windows 10 and 11 |
Key Capabilities
Initial Access Formats
EDR Evasion Methods
C2 Framework Integration
Native shellcode and stager compatibility across every major C2 framework used in professional red team engagements.
- All Commercial C2s (Tutorial available)
- Adaptix C2 (Tutorial available)
- Sliver (Tutorial available)
- Mythic Apollo, Merlin, etc (Tutorial available)
- Empire (PowerShell and .NET agents)
- Other Open Source C2s
Ready to use Scenarios
- 1Shellcode Loader (embedded and remote)
- 2DotNET Assembly Weaponization
- 3Drop and execute exe, dll, scripts (including with DLL sideloading)
- 4Downlowd and execute a payload
- 5Malicious Clickonce and MSI installers
- 6Run a command line
- 7Run weaponized Python script
- 8Target Enumeration
- 9Social Engineering tricks
EDR Bypass Profiles
Pre-built, production-tested profiles for major EDRs and Antivirus. Select a profile for your target environment and MacroPack applies the appropriate bypass chain automatically.
Each profile is tuned to the specific detection logic of the target EDR, not a generic bypass.
Profiles combines format, execution method, and evasion technique for common engagement scenarios.
Profiles are updated as EDR vendors release new detection improvements. Licenses include regular profile updates.
MITRE ATT&CK Technique Coverage
MacroPack generates payloads that accurately reproduce documented threat actor TTPs. Each output format and execution method maps to specific ATT&CK techniques - critical for threat-intelligence-led engagements where scenario accuracy is verified against the Threat Intelligence Report.
Technique coverage is used by red teams to verify scenario accuracy against the Threat Intelligence Report in TIBER-EU and equivalent intelligence-led red team programs globally.
MacroPack for TIBER-EU Initial Access
TIBER scenarios demand threat-intelligence-led attack vectors that accurately emulate specific threat actor TTPs. MacroPack's configurable execution chains, metadata control, and per-target evasion profiles make threat-actor-accurate payload generation executable without custom development per engagement.
Learn how BallisKit supports TIBER-EUPricing
- All use case and turnkey payloads
- All 29+ output formats
- All EDR bypass profiles
- Regular updates including EDR evasion
- Customization, history, and custom presets
- Discord and Email support
Bundle pricing available with ShellcodePack and DarwinOps.
Volume licensing for 3+ users. Contact contact@balliskit.com.
Professional email required. Anonymized or consumer domains not accepted.
Tutorials and Resources
Tutorial: Adaptix C2 with ShellcodePack and MacroPack
Learn how to weaponize Adaptix C2 Agents with BallisKit redteaming tools
Tutorial: Mythic Apollo with BallisKit MacroPack and ShellcodePack
Learn how to weaponize Mythic Apollo with BallisKit redteaming tools
Obfuscation and weaponization of .NET assemblies using MacroPack
For a couple of years now, .NET have been the go to language for a lot of famous offensive security tools like Rubeus, SeatBelt…