A BOF, or Beacon Object File, is a compact post-exploitation module that runs operator code inside a live process, commonly a beacon or other implanted agent. Instead of dropping a full tool to disk, the attacker loads the BOF into memory and executes it within the target process context.
This matters because it reduces file artifacts, can blend into an existing process, and lets operators extend capabilities on demand for tasks such as system discovery, credential checks, or lateral-movement preparation. In practice, BOFs are often used by red teams and by threat actors that want flexible, low-noise tradecraft. Defenders should look for unusual in-memory execution, suspicious module loading, process injection patterns, and endpoint telemetry that shows a trusted process suddenly performing new actions. Memory analysis and behavior-based detection are especially useful, because a BOF may never appear as a standalone executable on disk.