CScriptShell, a Powershell Host running within cscript.exe

PoC for persisting .NET payloads in Windows Notification Facility (WNF) state names using low-level Windows Kernel API calls.

Ruxcon2016 POC Code

A collection of free miscellaneous Windows tools

Lateral Movement graph for Azure Active Directory

A Utility for Measuring C++ Code Bloat

See adversary, do adversary: Simple execution of commands for defensive tuning/research (now with more ELF on the shelf)

PowerKrabsEtw is a PowerShell interface for doing real-time ETW tracing.

Automate AV evasion by calling AMSI

.NET library for logging data via EventSource/ETW

Windows Detour Hooking in PowerShell

NCC Group Ransomware Simulator

A tool to create COM class/interface relationships in neo4j

C# code for Transferring Backdoor Payloads by DNS Traffic (A - PTR Records) and Bypassing Anti-viruses

DotNext 2019 St. Petersburg Talk Demos

PowerShellMethodAuditor listens to the PowerShell ETW provider and logs PowerShell method invocations.

Process / thread-level system call tracer for Windows 7 / 8 / 2008 / 2012

Tool to decrypt encrypted strings in AgentTesla

This is just a simple Prefetch Parser developed in C#