LsvanDarko

edr-internals

Tools for analyzing EDR agents

seccomp-tools

Provide powerful tools for seccomp analysis

MrHandler

Linux Incident Response Reporting

grpctunnel

gRPC Tunneling

easyseccomp

DSL language to write seccomp filters

IconJector

Unorthodox and stealthy way to inject a DLL into the explorer using icons

evilarc

Create tar/zip archives that can exploit directory traversal vulnerabilities

ghostwire

[Edgeshark] Virtual communication discovery in container hosts

turtlefinder

reusable container engine discovery, not only for Edgeshark

clodl

Turn dynamically linked ELF binaries and libraries into self-contained closures.

CVE-2024-21111

Oracle VirtualBox Elevation of Privilege (Local Privilege Escalation) Vulnerability

Cave-Finder

Tool to find code cave in PE image (x86 / x64) - Find empty space to place code in PE files

lxkns

Discover Linux kernel namespaces in Go. Almost everywhere. Aware of various OCI container engines, even engines in containers.

core

Common Open Research Emulator

CrimsonEDR

Simulate the behavior of AV/EDR for malware development training.

Awesome-Cellular-Hacking

Awesome-Cellular-Hacking

xzbot

notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)

cackle

A code ACL checker for Rust

mail-in-the-middle

fwknop

Single Packet Authorization > Port Knocking

CVE-2024-1086

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images.

tracecat

The open source Tines / Splunk SOAR alternative.

unKover

PoC Anti-Rootkit to uncover Windows Drivers/Rootkits mapped to Kernel Memory.

Collect-MemoryDump

Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR

zed

Code at the speed of thought – Zed is a high-performance, multiplayer code editor from the creators of Atom and Tree-sitter.

impulse-xdr

Fully automated host & network intrusion detection platform. Detects malware from behavioural patterns rather than signatures and enables deeper visibility than legacy tools.

titanldr-ng

A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge years ago.

oci-seccomp-bpf-hook

OCI hook to trace syscalls and generate a seccomp profile

udica

This repository contains a tool for generating SELinux security profiles for containers

CarbonCopy

A tool which creates a spoofed certificate of any online website and signs an Executable for AV Evasion. Works for both Windows and Linux