countercept
There are 0 repository under countercept topic.
WithSecureLabs / chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
Language:Rust 2559A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.
Language:Python 1019A helper script for unpacking and decompiling EXEs compiled from python code.
Language:Python 866A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)
Language:C++ 379A python2 script for processing a PCAP file to decrypt C2 traffic sent to DOUBLEPULSAR implant
Language:Python 226- Language:Shell 217
- LinuxCatScale
Incident Response collection and processing scripts with automated reporting scripts
Language:Shell 216 Scripts for performing and detecting parent PID spoofing
Language:PowerShell 134- Language:Svelte 121
A utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use in testing detection techniques or other security research.
Language:C 111https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/
Language:C++ 110A spiritual .NET equivalent to the Gargoyle memory scanning evasion technique
Language:C# 50- Language:C# 30
- Language:Objective-C 28
A document tagging library
Language:Rust 28A collection of useful radare2 scripts!
Language:Python 26A triage data collection script for macOS
Language:Shell 24RemotePSpy provides live monitoring of remote PowerShell sessions, which is particularly useful for older (pre-5.0) versions of PowerShell which do not have comprehensive logging facilities built in.
Language:Python 19A higher-level wrapper on top of the official bson & mongodb crates.
Language:Rust 15- Language:Python 14
- Language:Python 11
Scripts for extracting useful information from infected memory dumps
Language:PowerShell 8Tools related to 'shadowhammer' attack, https://securelist.com/operation-shadowhammer/89992
Language:Python 7- Language:Python 6
snake-scales - the default repository of snake scales
Language:Python 5- Language:C++ 5
Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process.
Language:C 4- Language:Svelte 2
- Language:Python 1
snake-charmer - the regression test suite for snake
Language:Python