bigbrobro's repositories
Ares
Project Ares is a Proof of Concept (PoC) loader written in C/C++ based on the Transacted Hollowing technique
BackupOperatorToDA
From an account member of the group Backup Operators to Domain Admin without RDP or WinRM on the Domain Controller
BofAllTheThings
Creating a repository with all public Beacon Object Files (BoFs)
DemoCode
Some code for demonstration
ehids-agent
A Linux Host-based Intrusion Detection System based on eBPF.
Elkeid-HUB
Elkeid HUB is a rule/event processing engine maintained by the Elkeid Team that supports streaming/offline (not yet supported by the community edition) data processing. The original intention is to solve complex data/event processing and external system linkage requirements through standardized rules.
ESFang
ESF modular ingestion tool for development and research.
FalconFriday
Bi-weekly hunting queries
FunctionStomping
A new shellcode injection technique. Given as C++ header, standalone Rust program or library.
godlp
sensitive information protection toolkit
GoldenCopy
Copy the properties and groups of a user from neo4j (bloodhound) to create an identical golden ticket.
iMonitor
iMonitor（冰镜 - 终端行为分析系统）
inject-assembly
Inject .NET assemblies into an existing process
iris-web
Incident Response collaborative platform
Ivy
Ivy is a payload creation framework for the execution of arbitrary VBA (macro) source code directly in memory. Ivy’s loader does this by utilizing programmatical access in the VBA object environment to load, decrypt and execute shellcode.
KrbRelay
Framework for Kerberos relaying
LdapSignCheck
Beacon Object File & C# project to check LDAP signing
PackMyPayload
A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX
pe2shc-to-cdb
Convert shellcode generated using pe_2_shellcode to cdb format.
process_overwriting
Yet another variant of Process Hollowing
rita
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
RogueAssemblyHunter
Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.
SharpGhosting
Process Ghosting in C#
Simple-Reverse-Shell
Simple reverse shell to avoid Win 11 defender detection
sliver
Adversary Emulation Framework
WMEye
WMEye is a post exploitation tool that uses WMI Event Filter and MSBuild Execution for lateral movement
