sbousseaden

Windows Events Attack Samples

Misc Threat Hunting Resources

PCAP Samples for Different Post Exploitation Techniques

Random hunting ordiented yara rules

JSON DataSet for macOS mapped to MITRE ATT&CK Tactics.

EDRUnChoker - fileless WMI defense that removes EDRChoker QoS throttling policies

Memory API proxy via signed mozglue.dll

Windows process injection methods

A testing framework for mail security and filtering solutions.

A post exploitation framework designed to operate covertly on heavily monitored enviroments

Indicators of compromise (IOCs) collected from public resources and categorized by Qi-AnXin.

Malware source code samples leaked online uploaded to GitHub for those who want to analyze the code.

Import Windows Eventlogs(.evtx) to ElasticSearch.

APT & CyberCriminal Campaign Collection

A codebase aimed to make interaction with Windows and native execution easier

Volatility plugin for extracts configuration data of known malware

Sample queries for Advanced hunting in Microsoft Defender ATP

Searches For Threat Hunting and Security Analytics

Indicators of Compromises (IOC) of our various investigations

Win 10 related research

A free but powerful Windows kernel research tool.

Defeating Windows User Account Control

Interesting apt report collection and some special ioc express

SysmonX - An Augmented Drop-In Replacement of Sysmon

Repository of yara rules

Best Practice Auditd Configuration

This repo covers some code execution and AV Evasion methods for Macros in Office documents

Rules for Elastic Security's detection engine

Extension to osquery windows that enhances it with real-time telemetry, log monitoring and other endpoint data collection

Exchange Log Collection Script

Exploit the credentials present in files and memory

Small random scripts for various things I find myself needing to repeat/automate

Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.

Hook system calls, context switches, page faults and more.

PowerSploit - A PowerShell Post-Exploitation Framework

PE File Blessing - To continue or not to continue

Set of tools to analyze and attack Windows sandboxes.

Open-Source Remote Administration Tool For Windows C# (RAT)

A VBA implementation of the RunPE technique or how to bypass application whitelisting.

This repo contains samples that demonstrate the API used in Windows classic desktop applications.

The Source Code of HyperDbg Debugger 🐞

This is a webshell open source project

Indicator of Compromise Scanner for CVE-2019-19781

ObscurityLabs RedTeam C# Toolkit

Scripted Local Linux Enumeration & Privilege Escalation Checks

Seven different DLL injection techniques in one single project.

Generic Signature Format for SIEM Systems

PowerShell Obfuscation Detection Framework

No description.

Trying to tame the three-headed dog.

DEFCON 27 workshop - Modern Debugging with WinDbg Preview

SMBExec C# module

No description.

No description.

Elastic Security detection content for Endpoint

signed-loaders documents Windows executables that can be used for side-loading DLLs.

PoC for triggering buffer overflow via CVE-2020-0796

Windows Protocol Test Suites provide interoperability testing against an implementation of the Windows open specifications.

Deserialization payload generator for a variety of .NET formatters

CVE-2020-0688_EXP Auto trigger payload & encrypt method

MBC content in markdown

Live forensic artifacts collector

Leaked AzoRult Panel

Empire is a PowerShell and Python post-exploitation agent.

Using Windows Hook to make a CLI WebShellKill

ConventionEngine - A Yara Rulepack for PDB Path Hunting

collateral from http://basicinputoutput.com

RegRipper version 2.8

RCS Agent for Windows (32bit)

SharpSploit is a .NET post-exploitation library written in C#

Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)