Lists (7)
Stars
C2-agnostic BOF collection, categorized by attack chain phase. Designed to be small and modular, allowing for quick execution and automation.
Havoc C2 BOF — WFP kernel-space SYSTEM escalation + command execution with indirect syscalls, patchless AMSI/ETW bypass, and return address spoofing
abusing windows toast notifications for fun and user manipulation
Ansible Role for Ludus to provision or remove a device to/from a Tailnet.
A Cobalt Strike RL built with Crystal Palace — module overloading, NtContinue entry transfer, call stack spoofing, sleep masking, and static signature removal.
SparkyFitness: Built for Families. Powered by AI. Track food, fitness, water, and health — together.
The open-source voice synthesis studio
Project for generating and identifying deceptive LNK files.
Realm is a cross platform Red Team engagement platform with a focus on automation and reliability.
Proof of Concept (PoC) implant for creating custom Cobalt Strike Beacons
A Rust template for writing Beacon Object Files (BOFs)
Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass
Demonstrates consuming from a SecurityTrace ETW session by consuming from the Threat-Intelligence ETW provider without a driver or PPL privilege
Customizable Linux Persistence Tool for Security Research and Detection Engineering.
An alternative to the builtin clipboard feature in Cobalt Strike that adds the capability to enable/disable and dump the clipboard history.
A 64-bit ELF loader in C to avoid use of execve. Supports loading and executing statically linked non-PIE and PIE binaries on Linux.
Beacon Object File for Cobalt Strike that executes .NET assemblies in beacon with evasion techniques.