Cerbersec / notes
Resources and articles I need to take a look at. Mostly about malware/exploit development and analysis.
☆81Updated 3 years ago
Alternatives and similar repositories for notes:
Users that are interested in notes are comparing it to the libraries listed below
- ☆112Updated 2 years ago
- Do some DLL SideLoading magic☆77Updated last year
- ☆134Updated last year
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆111Updated last year
- A fake AMSI Provider which can be used for persistence.☆141Updated 3 years ago
- Identify and exploit leaked handles for local privilege escalation.☆105Updated last year
- Experiment on reproducing Obfuscate & Sleep☆141Updated 3 years ago
- Infect Shared Files In Memory for Lateral Movement☆193Updated 2 years ago
- ☆132Updated 2 years ago
- Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post☆88Updated 2 years ago
- POC for frustrating/defeating Malware Analysts☆155Updated 2 years ago
- A tool for converting SysWhispers3 syscalls for use with Nim projects☆142Updated 2 years ago
- It's pointy and it hurts!☆122Updated 2 years ago
- RDLL for Cobalt Strike beacon to silence sysmon process☆87Updated 2 years ago
- A variation of ProcessOverwriting to execute shellcode on an executable's section☆147Updated last year
- A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…☆169Updated last year
- ShellWasp is a tool to help build shellcode that utilizes Windows syscalls, while overcoming the portability problem associated with Wind…☆165Updated last year
- Simple BOF to read the protection level of a process☆114Updated last year
- The program uses the Windows API functions to traverse through directories and locate DLL files with RWX section☆98Updated last year
- Patch AMSI and ETW in remote process via direct syscall☆80Updated 2 years ago
- Evasive Process Hollowing Techniques☆135Updated 4 years ago
- Building and Executing Position Independent Shellcode from Object Files in Memory☆154Updated 4 years ago
- Beacon Object File Loader☆282Updated last year
- Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2☆179Updated 2 years ago
- Hookers are cooler than patches.☆168Updated 3 years ago
- Detect strange memory regions and DLLs☆174Updated 3 years ago
- Utilizing hardware breakpoints to evade monitoring by Endpoint Detection and Response platforms☆115Updated 2 years ago
- Create Anti-Copy DRM Malware☆51Updated 5 months ago
- Deleting Shadow Copies In Pure C++☆114Updated 2 years ago
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆122Updated 2 years ago