wsummerhill

magika

Detect file content types with deep learning

flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

NetExec

The Network Execution Tool

PyRIT

The Python Risk Identification Tool for generative AI (PyRIT) is an open access automation framework to empower security professionals and machine learning engineers to proactively find risks in their generative AI systems.

CursedChrome

Chrome-extension implant that turns victim Chrome browsers into fully-functional HTTP proxies, allowing you to browse sites as your victims.

Shhhloader

Syscall Shellcode Loader (Work in Progress)

Stardust

A modern 64-bit position independent implant template

CredMaster

Refactored & improved CredKing password spraying tool, uses FireProx APIs to rotate IP addresses, stay anonymous, and beat throttling

GraphRunner

A Post-exploitation Toolset for Interacting with the Microsoft Graph API

TelemetrySourcerer

Enumerate and disable common sources of telemetry used by AV/EDR.

SilkETW

PortBender

TCP Port Redirection Utility

Misconfiguration-Manager

Misconfiguration Manager is a central knowledge base for all known Microsoft Configuration Manager tradecraft and associated defensive and hardening guidance.

pywhisker

Python version of the C# tool for "Shadow Credentials" attacks

GraphStrike

Cobalt Strike HTTPS beaconing over Microsoft Graph API

Evilginx2-Phishlets

Evilginx3 Phishlets version (0.2.3 & above) Only For Testing/Learning Purposes

MultiDump

MultiDump is a post-exploitation tool for dumping and extracting LSASS memory discreetly.

SharpADWS

Active Directory reconnaissance and exploitation for Red Teams via the Active Directory Web Services (ADWS).

ThreadlessInject-BOF

BOF implementation of @_EthicalChaos_'s ThreadlessInject project. A novel process injection technique with no thread creation, released at BSides Cymru 2023.

caOptics

CA Optics - Azure AD Conditional Access Gap Analyzer

NativeDump

Dump lsass using only Native APIs by hand-crafting Minidump files (without MinidumpWriteDump!)

COM-Hunter

COM Hijacking VOODOO

PurpleLab

PurpleLab is an efficient and readily deployable lab solution, providing a swift setup for cybersecurity professionals to test detection rules, simulate logs, and undertake various security tasks, all accessible through a user-friendly web interface

PurpleOps

An open-source self-hosted purple team management web application.

MutationGate

Use hardware breakpoint to dynamically change SSN in run-time

ccmpwn

CsWhispers

Source generator to add D/Invoke and indirect syscall methods to a C# project.

Cobalt-Strike-Profiles-for-EDR-Evasion

Cobalt Strike Profiles for EDR Evasion

PPLFaultDumpBOF

Evasive-Loader

Evasive loader to bypass static detection