Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.

Alternative Shellcode Execution Via Callbacks

Evasive shellcode loader for bypassing event-based injection detection (PoC)

Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassing ETW+AMSI, avo…

POCs for Shellcode Injection via Callbacks

Sysmon-Like research tool for ETW

A header-only C++ library for accessing files in COFF binary format. (Including Windows PE/PE+ formats)

PoC MSVC COFF Object file loader/injector.

Collection of Beacon Object Files (BOF) for Cobalt Strike

Collection of DLL function export forwards for DLL export function proxying

A C++ POC for process injection using NtCreateSectrion, NtMapViewOfSection and RtlCreateUserThread. Credit to @spotheplanet for his notes.