Lists (32)
Adversary Simulation
Adversary simulationsAI-LLM
Promp engineering etc.Attack Simulation and Automation
Attack simulation, detection engineering, purple teaming. etc.Blue Team Tools
Data Science
Data Visualization
Interactive dashboarding etc.DFIR
DFIR and Hunting Tools
Useful tools for threat hunting and DFIRDFIR: Cloud
Graph
Identity and Cloud
Entra ID, Azure related ttack and defenseJupyter and Python
Knowledge Repos
LOLBins, query repos, etc.Lab Environment and Automation
Malware Analysis and YARA
Microsoft Sentinel and Defender
Red Team: Collection
Red Team: Command and Control
RAT tools etc.Red Team: Credential Access
Red Team: Defense Evasion
Red Team: Discovery
Bloodhound, Kubehound, and other stuffRed Team: Execution
Red Team: Exfiltration
Red Team: Initial Access
Phishing, etc.Red Team: Lateral Movement
Red Team: Persistence
Red Team: Privilege Escalation
Red Team: Reconnaissance
Red Team: Resource Development
Red Team Tools
Red team toolsSecurity Data Science
Training
Stars
Collection of UAC Bypass Techniques Weaponized as BOFs
BOF for Kerberos abuse (an implementation of some important features of the Rubeus).
BOF to steal browser cookies & credentials
A CobaltStrike toolkit to write files produced by Beacon to memory instead of disk
A small x64 library to load dll's into memory.
A beacon object file implementation of PoolParty Process Injection Technique.
Proof-of-Concept tool for extracting NTLMv1 hashes from sessions on modern Windows systems.
Encrypted shellcode Injection to avoid Kernel triggered memory scans
CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking
Huffman Coding in Shellcode Obfuscation & Dynamic Indirect Syscalls Loader.
Porting of BOF InlineExecute-Assembly to load .NET assembly in process but with patchless AMSI and ETW bypass using hardware breakpoint.
Two tools written in C that block network traffic for blacklisted EDR processes, using either Windows Defender Firewall (WDF) or Windows Filtering Platform (WFP).
SilentButDeadly is a network communication blocker specifically designed to neutralize EDR/AV software by preventing their cloud connectivity using Windows Filtering Platform (WFP). This version fo…
Reflective shellcode loaderwith advanced call stack spoofing and .NET support.
The ADSyncDump BOF is a port of Dirk-Jan Mollema's adconnectdump.py / ADSyncDecrypt into a Beacon Object File (BOF) with zero dependencies.
Cobalt Strike + Brute Ratel C4 Beacon Object File (BOF) Conversion of the Mockingjay Process Injection Technique
Curated list of public Beacon Object Files(BOFs) build in as submodules for easy cloning
Lateral Movement Bof with MSI ODBC Driver Install
A version of NetLoader, Execute Assemblies and Bypass ETW and AMSI using Hardware Breakpoints