DirWangK

PowerShell

PowerShell for every system!

pics

File formats dissections and more...

raddebugger

A native, user-mode, multi-process, graphical debugger.

BypassAV

This map lists the essential techniques to bypass anti-virus and EDR

DidierStevensSuite

Please no pull requests for this repository. Thanks!

C3

Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.

EDR-Telemetry

This project aims to compare and evaluate the telemetry of various EDR products.

hypervisor

lightweight hypervisor SDK written in C++ with support for Windows, Linux and UEFI

DdiMon

Monitoring and controlling kernel API calls with stealth hook using EPT

go_parser

Yet Another Golang binary parser for IDAPro

Invisi-Shell

Hide your Powershell script in plain sight. Bypass all Powershell security features

EDRSilencer

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

redress

Redress - A tool for analyzing stripped Go binaries

invoke-atomicredteam

Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the [atomics folder](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics) of Red Canary's Atomic Red Team project.

saferwall

:cloud: Collaborative Malware Analysis Platform at Scale

DotNetDetour

DotNetDetour is a software package for monitoring and instrumenting API calls

GraphStrike

Cobalt Strike HTTPS beaconing over Microsoft Graph API

GoReSym

Go symbol recovery tool

CVE-2020-15368

CVE-2020-15368, aka "How to exploit a vulnerable driver"

Ultimate-RAT-Collection

For educational purposes only, samples of old & new malware builders including screenshots!

avred

Analyse your malware to surgically obfuscate it

FalconEye

Antimalware-Research

Research on Anti-malware and other related security solutions

FormThief

Spoofing desktop login applications with WinForms and WPF

SEPparser

Script for parsing Symantec Endpoint Protection logs, VBNs, and ccSubSDK database.

pdbWriter

A small tool to produce a dummy pdb for an executable with symbols at addresses from a file

SEDR-Internals

Symantec EDR Internals

avred-server

The AMSI server for Avred

EDRSnowblast

This project is an EDRSandblast fork, adding some features and custom pieces of code.

Norton_AntiVirus_SourceCode