hau-zy

dnstwist

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

BypassAV

This map lists the essential techniques to bypass anti-virus and EDR

EDRs

BlackLotus

BlackLotus UEFI Windows Bootkit

BloodHound.py

A Python based ingestor for BloodHound

msticpy

Microsoft Threat Intelligence Security Tools

Awesome-CloudSec-Labs

Awesome free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs.

Awesome-Vulnerability-Research

🦄 A curated list of the awesome resources about the Vulnerability Research

awesome-list

Cybersecurity oriented awesome list

Advanced-Process-Injection-Workshop

DEFCON-31-Syscalls-Workshop

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

PWF

Practical Windows Forensics Training

semgrep-rules

A collection of my Semgrep rules to facilitate vulnerability research.

KQL-threat-hunting-queries

A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

windows-dll-hijacking

Project for identifying executables and DLLs vulnerable to relative path DLL hijacking.

GhostTask

A tool employs direct registry manipulation to create scheduled tasks without triggering the usual event logs.

EvilSln

A New Exploitation Technique for Visual Studio Projects

Linux-Incident-Response

practical toolkit for cybersecurity and IT professionals. It features a detailed Linux cheatsheet for incident response

elastic-container

Stand up a simple Elastic container with Kibana, Fleet, and the Detection Engine

sharem

SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also contains its own custom disassembler, with many innovative features, such as being able to show the deobfuscated disassembly of an encoded shellcode, or integrating emulation data to enhance the disassembly.

frameless-bitb

A new approach to Browser In The Browser (BITB) without the use of iframes, allowing the bypass of traditional framebusters implemented by login pages like Microsoft and the use with Evilginx.

UnhookingPatch

Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime

threathunting-spl

Splunk code (SPL) for serious threat hunters and detection engineers.

CVE-2023-36874

TokenStealer

Mindmaps

Azure mindmap for penetration tests

Sentinel-SOC-101

Content and collateral for the Microsoft Sentinel SOC 101 series

hackthebox

My WriteUps for HackTheBox CTFs, Machines, and Sherlocks.

Teaching

A place in which I put various resources from my classes, presentations, and videos.

tabstate-util