countercept
There are 1 repository under countercept topic.
WithSecureLabs / chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
Language:Rust 2680A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.
Language:Python 1020A helper script for unpacking and decompiling EXEs compiled from python code.
Language:Python 892A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)
Language:C++ 407- LinuxCatScale
Incident Response collection and processing scripts with automated reporting scripts
Language:Shell 239 A python2 script for processing a PCAP file to decrypt C2 traffic sent to DOUBLEPULSAR implant
Language:Python 224- Language:Shell 215
Scripts for performing and detecting parent PID spoofing
Language:PowerShell 135- Language:Svelte 121
A utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use in testing detection techniques or other security research.
Language:C 113https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/
Language:C++ 111A spiritual .NET equivalent to the Gargoyle memory scanning evasion technique
Language:C# 50- Language:Objective-C 32
- Language:C# 30
A document tagging library
Language:Rust 29A collection of useful radare2 scripts!
Language:Python 27A triage data collection script for macOS
Language:Shell 25RemotePSpy provides live monitoring of remote PowerShell sessions, which is particularly useful for older (pre-5.0) versions of PowerShell which do not have comprehensive logging facilities built in.
Language:Python 18A higher-level wrapper on top of the official bson & mongodb crates.
Language:Rust 15- Language:Python 14
- Language:Python 11
Scripts for extracting useful information from infected memory dumps
Language:PowerShell 8- Language:Python 7
Tools related to 'shadowhammer' attack, https://securelist.com/operation-shadowhammer/89992
Language:Python 7Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process.
Language:C 6snake-scales - the default repository of snake scales
Language:Python 6- Language:C++ 5
- Language:Svelte 2
- Language:Python 1
snake-charmer - the regression test suite for snake
Language:Python