subat0mik

Misconfiguration-Manager

Misconfiguration Manager is a central knowledge base for all known Microsoft Configuration Manager tradecraft and associated defensive and hardening guidance.

whoamsi

An effort to track security vendors' use of Microsoft's Antimalware Scan Interface

Journey_to_OSCE

A curated collection of resources that may be beneficial for anyone pursuing the OSCE.

bypasses

dnSpy

.NET debugger and assembly editor

LdapRelayScan

Check for LDAP protections regarding the relay of NTLM authentication

osed-scripts

bespoke tooling for offensive security's Windows Usermode Exploit Dev course (OSED)

printspoofer.net

rdpthief_dllinjection

scripts

shellcode-runners

Various shellcode runners

win32

Public mirror for win32-pr

win_api

Learning the arcane arts of the Windows API.

WinDbg-Samples

Sample extensions, scripts, and API uses for WinDbg.

windows-itpro-docs

This is used for contributions to the Windows 10 content for IT professionals on docs.microsoft.com.

Advanced-Process-Injection-Workshop

Apollo

A .NET Framework 4.0 Windows Agent

.github

chronology

SpecterOps Historical Records

docker-bloodhound

BloodHound Docker Ready to Use

minidump

Simple C# program to call MiniDumpWriteDump to dump LSASS memory.

MSSQL_Scripts

Various scripts/tools for enumerating and abusing MSSQL.

personal_site

PetitPotam

PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.

PEzor

Open-Source PE Packer

SCShell

SCShell implementation from scratch done as part of the PEN-300 course.

Seatbelt

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

SharpDPAPI

SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.

SharpSCCM

A C# utility for interacting with SCCM

Whisker

Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account.