ruppde

PowerToys

Windows system utilities to maximize productivity

MalwareSourceCode

Collection of malware source code for a variety of platforms in an array of different programming languages.

VoiceCraft

Zero-Shot Speech Editing and Text-to-Speech in the Wild

xzbot

notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)

endlessh-go

A golang implementation of endlessh exporting Prometheus metrics, visualized by a Grafana dashboard.

Misconfiguration-Manager

Misconfiguration Manager is a central knowledge base for all known Microsoft Configuration Manager tradecraft and associated defensive and hardening guidance.

LOOBins

Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.

realm

Realm is a cross platform Red Team engagement platform with a focus on automation and reliability.

Caro-Kann

Encrypted shellcode Injection to avoid Kernel triggered memory scans

blint

BLint is a Binary Linter to check the security properties, and capabilities in your executables. Since v2, blint is also an SBOM generator for binaries.

dekryptize

A ncurses animation to make decryption look like, well, decryption.

Sigma-Rules

A repository of my own Sigma detection rules.

xz-vulnerable-honeypot

An ssh honeypot with the XZ backdoor. CVE-2024-3094

WhoIsWho

Amazing whoami alternatives

xzre

XZ backdoor reverse engineering

HttpRemotingObjRefLeak

Additional resources for leaking and exploiting ObjRefs via HTTP .NET Remoting (CVE-2024-29059)

Yara-detection-rules

Yara Rules for Modern Malware

Amaterasu

Amaterasu terminates, or inhibits, protected processes such as application control and AV/EDR solutions by leveraging the Sysinternals Process Explorer driver to kill a process's handles from kernel mode.

nviso-cti

DotNet-MetaData

Identifies metadata of .NET binary files.

100-Days-of-YARA-2024

StalkPhish-OSS

StalkPhish-OSS - The Phishing kits stalker, harvesting phishing kits for investigations.

NetScaler-Password-Hash-Type-5

An analysis of the user password hashing algorithm used by Citrix NetScaler

yara-rules

YARA rules for malware detection/classification

CVE-2024-21388

This Python script exploits a vulnerability (CVE-2024-21388) in Microsoft Edge, allowing silent installation of browser extensions with elevated privileges via a private API.

evilarc

Create tar/zip archives that can exploit directory traversal vulnerabilities

technical-reports

This repository contains information related to Basque Cybersecurity Centre investigations and public reports: iocs, yara rules, snort rules, sigma rules and so on.

depproxy

Go module proxy that only allows authorized modules

yara-rules-repo

The collection of YARA rules to perform malware threat hunting and detection.

wpress-extractor

Standalone python3 script for extracting and creating .wpress wordpress archives