DfirJos / CnC-detectionLinks
Detecting PowerShell Empire, Metasploit Meterpreter and Cobalt Strike agents by payload size sequence analysis and host correlation
☆15Updated 7 years ago
Alternatives and similar repositories for CnC-detection
Users that are interested in CnC-detection are comparing it to the libraries listed below
Sorting:
- Code for blogpost: https://outflank.nl/blog/2018/10/25/building-resilient-c2-infrastructues-using-dns-over-https/☆54Updated 7 years ago
- Everything related to Cobalt Strike☆15Updated 5 years ago
- Powershell script which will take any payload and put it in the a bat script which delivers the payload. The payload is delivered using e…☆55Updated last year
- Cobalt Strike Field Manual - A quick reference for Windows commands that can be accessed in a beacon console.☆65Updated 8 years ago
- Remote process dumping automation. Use it to dump Windows credentials remotely and extract clear text with Mimikatz offline☆35Updated 6 years ago
- Community maintained list of most popular HIPS service and process names on a Windows Platform.☆43Updated this week
- Exercises for C# Workshop at Wild West Hackin' Fest 2018 & 2019.☆64Updated 6 years ago
- ☆69Updated 7 years ago
- SilkETW & SilkService☆40Updated 6 years ago
- The project is called GreatSCT (Great Scott). GreatSCT is an open source project to generate application white list bypasses. This tool i…☆29Updated 7 years ago
- LogRM is a post exploitation powershell script which it uses windows event logs to gather information about internal network☆74Updated 6 years ago
- A collection of shell code conversion scripts that I have written over time for repetitive tasks☆19Updated 6 years ago
- Microsoft Applocker evasion tool☆39Updated 6 years ago
- Bash one-liner that will parse harmj0y's SharpRoast or Rebeus kerberoast into hashcat crack-able format.☆32Updated 6 years ago
- Babel-Shellfish deobfuscates and scans Powershell scripts on real-time right before each line execution.☆43Updated 7 years ago
- Quick PoC I Wrote for Bypassing Next Gen AV Remotely for Pentesting☆41Updated 6 years ago
- Splunk Dashboard for CobaltStrike logs☆90Updated 4 years ago
- Convert Empire profiles to Apache mod_rewrite scripts☆28Updated 6 years ago
- Cobalt Strike log state tracking, parsing, and storage☆24Updated 6 years ago
- ☆20Updated 7 years ago
- Windows GUI/Execution Engine for Atomic Red Team Atomics☆35Updated 5 years ago
- ☆13Updated 4 years ago
- Gives context to a system. Uses EQGRP shadow broker leaked list to give some descriptions to processes.☆48Updated 8 years ago
- PoC that manipulates Windows file times using SetFileTime() API☆63Updated 6 years ago
- Random source codes☆26Updated 2 weeks ago
- Extract the password of the current user from flow (keylogger, config file, ..) Use SSPI to get a valid NTLM challenge/response and test …☆59Updated 6 years ago
- ☆25Updated 7 years ago
- Ps1jacker is a tool for generating COM Hijacking payload.☆60Updated 10 months ago
- ☆45Updated 7 years ago
- ☆17Updated 10 years ago