rasta-mouse

ThreatCheck

Identifies the bytes that Microsoft Defender / AMSI Consumer flags on.

SharpC2

Command and Control Framework written in C#

OST-C2-Spec

Open Source C&C Specification

CsWhispers

Source generator to add D/Invoke and indirect syscall methods to a C# project.

DInvoke

Dynamically invoke arbitrary unmanaged code from managed code without P/Invoke.

process-inject-kit

Port of Cobalt Strike's Process Inject Kit

PPEnum

Simple BOF to read the protection level of a process

SCMUACBypass

SpawnWith

MinHook.NET

A C# port of the MinHook API hooking library

KerbApp

offensive-defence

PacketAlchemy

Playing with packets in C#

Covenant

Covenant is a collaborative .NET C2 framework for red teamers.

EDD

Enumerate Domain Data

PrettyPrompt

A cross-platform command line input library that provides syntax highlighting, autocompletion, history and multi-line input.

rust_syscalls

Single stub direct and indirect syscalling with runtime SSN resolving for windows.

injdrv

proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC

LOLDrivers

Living Off The Land Drivers

rastamask-vs

A SleepMask using BeaconGate

SharpC2-Docs

InlineExecute-Assembly

InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module

MalSCCM

SharpSCCM

A C# utility for interacting with SCCM

SQLRecon

A C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation.

DGPOEdit

Disconnected GPO Editor - A Group Policy Manager launcher to allow editing of domain GPOs from non-domain joined machines

EyeWitness

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

InfoSec-Black-Friday

All the deals for InfoSec related software/tools this Black Friday

bof-vs

A Beacon Object File (BOF) template for Visual Studio

RunOF