Stars
My implementation of enSilo's Process Doppelganging (PE injection technique)
Azure Outlook Command & Control (C2) - Remotely control a compromised Windows Device from your Outlook mailbox. Threat Emulation Tool for North Korean APT InkySquid / ScarCruft / APT37. TTP: Use Mi…
Hellsgate + Halosgate/Tartarosgate. Ensures that all systemcalls go through ntdll.dll
An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.
A Linux Host-based Intrusion Detection System based on eBPF.
Local privilege escalation via PetitPotam (Abusing impersonate privileges).
PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.
C++ self-Injecting dropper based on various EDR evasion techniques.
Fast Conversion Windows Dynamic Link Library To ShellCode
The first analysis framework for CPU microcode
BOF implementation of @_EthicalChaos_'s ThreadlessInject project. A novel process injection technique with no thread creation, released at BSides Cymru 2023.
Harvest passwords automatically from OpenSSH server
.NET assembly loader with patchless AMSI and ETW bypass
New lateral movement technique by abusing Windows Perception Simulation Service to achieve DLL hijacking code execution.
CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking
Porting of BOF InlineExecute-Assembly to load .NET assembly in process but with patchless AMSI and ETW bypass using hardware breakpoint.