sbousseaden

injection-1

Windows process injection methods

evtx2es

Import Windows Eventlogs(.evtx) to ElasticSearch.

APT_CyberCriminal_Campagin_Collections

APT & CyberCriminal Campaign Collection

MalConfScan

Volatility plugin for extracts configuration data of known malware

WindowsDefenderATP-Hunting-Queries

Sample queries for Advanced hunting in Microsoft Defender ATP

APT_REPORT

Interesting apt report collection and some special ioc express

auditd

Best Practice Auditd Configuration

rules

Repository of yara rules

sysmonx

SysmonX - An Augmented Drop-In Replacement of Sysmon

UACME

Defeating Windows User Account Control

AsyncRAT-C-Sharp

Open-Source Remote Administration Tool For Windows C# (RAT)

defcon_27_windbg_workshop

DEFCON 27 workshop - Modern Debugging with WinDbg Preview

HastySeries

ObscurityLabs RedTeam C# Toolkit

InfinityHook

Hook system calls, context switches, page faults and more.

injection

office-exploit-case-study

OneOffs

Small random scripts for various things I find myself needing to repeat/automate

osq-ext-bin

Extension to osquery windows that enhances it with real-time telemetry, log monitoring and other endpoint data collection

PeFixup

PE File Blessing - To continue or not to continue

PowerSploit

PowerSploit - A PowerShell Post-Exploitation Framework

sandbox-attacksurface-analysis-tools

Set of tools to analyze and attack Windows sandboxes.

unicorn

Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.

VBA-RunPE

A VBA implementation of the RunPE technique or how to bypass application whitelisting.

Win10

Win 10 related research

azorult

Leaked AzoRult Panel

ConventionEngine

ConventionEngine - A Yara Rulepack for PDB Path Hunting

Empire

Empire is a PowerShell and Python post-exploitation agent.

pinjectra

Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)

RegRipper2.8

RegRipper version 2.8

SharpSploit

SharpSploit is a .NET post-exploitation library written in C#