Ap3x

cilium

eBPF-based Networking, Security, and Observability

LIEF

LIEF - Library to Instrument Executable Formats

ghw

Go HardWare discovery/inspection library

lessmsi

A tool to view and extract the contents of an Windows Installer (.msi) file.

win32

Public mirror for win32-pr

AntiCheat-Testing-Framework

Framework to test any Anti-Cheat

Windows10-CustomKernelSigners

Load self-signed drivers without TestSigning or disable DSE. Transferred from https://github.com/DoubleLabyrinth/Windows10-CustomKernelSigners

SOREL-20M

Sophos-ReversingLabs 20 million sample dataset

GoRedOps

🦫 | GoRedOps is a repository dedicated to gathering and sharing advanced techniques and offensive malware for Red Team, with a specific focus on the Go programming language, all is made for educational purpoeses only.

COM-Hunter

COM Hijacking VOODOO

KExecDD

Admin to Kernel code execution using the KSecDD driver

malware_api_class

Malware dataset for security researchers, data scientists. Public malware dataset generated by Cuckoo Sandbox based on Windows OS API calls analysis for cyber security researchers

The_Shelf

Retired TrustedSec Capabilities

gdrv-loader

Kernel driver loader using vulnerable gigabyte driver (https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities) to load a unsigned driver

illusion-rs

Rusty Hypervisor - Windows UEFI Blue Pill Type-1 Hypervisor in Rust (Codename: Illusion)

MDE_Enum

comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reduction (ASR) rules without Admin privileges

reverse-engineering-workshop

Slides & Hands-on for the reverse engineering workshop

ntoskrnl

The Windows Research Kernel (WRK)

Venoma

Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution

PPLSystem

DirtyCLR

An App Domain Manager Injection DLL PoC on steroids

Threat-Actors-use-of-Artifical-Intelligence

ItsNotASecurityBoundary

user-kernel-syscall-hook

KReClassEx

Kernel ReClassEx

TS-Changer

TS-Changer - Forces the machine in/out of TestSigning Mode at runtime.

MSFT_DriverBlockList

Repository of Microsoft Driver Block Lists based off of OS-builds

IPC-demo

Linux Inter Process Communication examples

DumpDriver

VerifierDLL

Example of building an application verifer DLL