DfirJos / CnC-detection
Detecting PowerShell Empire, Metasploit Meterpreter and Cobalt Strike agents by payload size sequence analysis and host correlation
☆16Updated 6 years ago
Alternatives and similar repositories for CnC-detection:
Users that are interested in CnC-detection are comparing it to the libraries listed below
- Presentation materials for talks I've given.☆20Updated 5 years ago
- Tweettioc Splunk App☆20Updated 4 years ago
- Community maintained list of most popular HIPS service and process names on a Windows Platform.☆43Updated 2 years ago
- Babel-Shellfish deobfuscates and scans Powershell scripts on real-time right before each line execution.☆42Updated 6 years ago
- Helper script for mangling CS payloads☆52Updated 5 years ago
- Everything related to Cobalt Strike☆15Updated 5 years ago
- Cobalt Strike log state tracking, parsing, and storage☆23Updated 5 years ago
- Bash one-liner that will parse harmj0y's SharpRoast or Rebeus kerberoast into hashcat crack-able format.☆32Updated 6 years ago
- SilkETW & SilkService☆40Updated 5 years ago
- The project is called GreatSCT (Great Scott). GreatSCT is an open source project to generate application white list bypasses. This tool i…☆29Updated 6 years ago
- Walking the PEB in VBA☆22Updated 4 years ago
- ☆20Updated 6 years ago
- IoC's, PCRE's, YARA's etc☆23Updated last week
- A cross platform tool for verifying credentials and executing single commands☆32Updated 5 years ago
- RemotePSpy provides live monitoring of remote PowerShell sessions, which is particularly useful for older (pre-5.0) versions of PowerShel…☆18Updated 5 years ago
- Cobalt Strike Field Manual - A quick reference for Windows commands that can be accessed in a beacon console.☆64Updated 7 years ago
- Powershell script which will take any payload and put it in the a bat script which delivers the payload. The payload is delivered using e…☆52Updated 11 months ago
- ☆16Updated 3 years ago
- ☆12Updated 6 years ago
- ☆17Updated 9 years ago
- Exercises for C# Workshop at Wild West Hackin' Fest 2018 & 2019.☆64Updated 5 years ago
- A collection of shell code conversion scripts that I have written over time for repetitive tasks☆18Updated 5 years ago
- Royal APT - APT15 - Related Information from NCC Group Cyber Defense Operations Research☆53Updated 6 years ago
- BloodHound Cypher Queries Ported to a Jupyter Notebook☆53Updated 4 years ago
- .net tool that uses WMI queries to enumerate active sessions and accounts configured to run services on remote systems☆33Updated 5 years ago
- A set of commands to bypass Defender (and some other AVs)☆20Updated 5 years ago
- Ingests logs/dbs from cobalt and empire and outputs an excel report with activity, sessions, and credentials☆20Updated 4 years ago
- Includes 5 Known Application Whitelisting/ Application Control Bypass Techniques in One File.☆31Updated 8 years ago
- Random source codes☆25Updated 4 years ago
- Microsoft Applocker evasion tool☆38Updated 5 years ago