> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/cobalt-strike/beacon-payloads/staged-vs-stageless-payloads/opsec.md).

# OPSEC

To keep the stagers as small as possible, they must omit steps that we may consider these days as 'good practice'. For instance, the full stageless payloads avoid the use of RWX (read, write, execute) memory because it stands out as anomalous in most Windows processes. Instead, they allocate memory as RW first, and then flips it to RX prior to execution. Payload stager don't do this because it requires an additional API call, which requires more ode. Stagers are often built in hand-optimised assembly, so every byte that can be saved, is. \
\
To give an idea on size difference - today, a Beacon stager is \~890 bytes and a full Beacon stage is \~307200 bytes That's it \~345 times larger.