reiterjr Goto Github PK

adversary_emulation_library

An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.

alpaca

Serialization library written in C++17 - Pack C++ structs into a compact byte-array without any macros or boilerplate code

analyzemft

anti-ransomware-minifilter

antihook_bitdefender

PoC designed to evade userland-hooking anti-virus.

apisetparse

Uses the PEB to obtain an apisetmap in order to translate umbrella DLL's such as "api-ms-win-http-time-l1-1-0.dll" to their origin forward DLL e.g. kernelbase.dll

artillery

UAC Bypass COM object to write to System32

athena

atompepacker

A Highly capable Pe Packer

awesome-av-edr-xdr-bypass

Awesome AV/EDR/XDR Bypass Tips

banshee-rootkit

Experimental Windows x64 Kernel Rootkit.

bdarkit-minifilter

just an lite AntiRootkit for interesting

beacon_source

not a reverse-engineered version of the Cobalt Strike Beacon

bin2sideload

bofs

Beacon Object Files (not Buffer Overflows)

certcheck

Programmatically access a TLS certificate chain in C++ and C#

childprocinjection

cookie-monster

BOF to steal browser cookies & credentials

createservice_win

File backup

cs-bofs

Collection of CobaltStrike beacon object files

cveac-2020-easyanticheat-bypass

EasyAntiCheat Integrity check bypass by mimicking memory changes

darkloadlibrary

LoadLibrary for offensive operations

ddimon-hooking

Monitoring and controlling kernel API calls with stealth hook using EPT

defcon-31-syscalls-workshop

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

dll-exports-extraction-bof

DLL Exports Extraction BOF with optional NTFS transactions.

dumpext

WinDbg debugger extension library providing various tools to analyse, dump and fix (restore) Microsoft Portable Executable files for both 32 (PE) and 64-bit (PE+) platforms.

edrception

A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.

edrsandblast

edrsilencer

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

efspotato

Exploit for EfsPotato(MS-EFSR EfsRpcOpenFileRaw with SeImpersonatePrivilege local privalege escalation vulnerability).