DfirJos / CnC-detectionLinks
Detecting PowerShell Empire, Metasploit Meterpreter and Cobalt Strike agents by payload size sequence analysis and host correlation
☆16Updated 6 years ago
Alternatives and similar repositories for CnC-detection
Users that are interested in CnC-detection are comparing it to the libraries listed below
Sorting:
- Bash one-liner that will parse harmj0y's SharpRoast or Rebeus kerberoast into hashcat crack-able format.☆32Updated 6 years ago
- Cobalt Strike log state tracking, parsing, and storage☆24Updated 5 years ago
- Community maintained list of most popular HIPS service and process names on a Windows Platform.☆43Updated 2 years ago
- Helper script for mangling CS payloads☆51Updated 6 years ago
- My musings with C#☆28Updated 2 years ago
- Babel-Shellfish deobfuscates and scans Powershell scripts on real-time right before each line execution.☆43Updated 6 years ago
- .net tool that uses WMI queries to enumerate active sessions and accounts configured to run services on remote systems☆33Updated 5 years ago
- Convert Empire profiles to Apache mod_rewrite scripts☆28Updated 5 years ago
- Presentation materials for talks I've given.☆20Updated 5 years ago
- Ingests logs/dbs from cobalt and empire and outputs an excel report with activity, sessions, and credentials☆20Updated 4 years ago
- C# Implementation of Get-VaultCredential☆14Updated 6 years ago
- Microsoft Applocker evasion tool☆39Updated 5 years ago
- ☆25Updated 6 years ago
- Everything related to Cobalt Strike☆15Updated 5 years ago
- Powershell script which will take any payload and put it in the a bat script which delivers the payload. The payload is delivered using e…☆53Updated last year
- Walking the PEB in VBA☆23Updated 5 years ago
- Exercises for C# Workshop at Wild West Hackin' Fest 2018 & 2019.☆64Updated 5 years ago
- ☆45Updated 6 years ago
- Discover MSSQL Instances via UDP Scanning☆25Updated 6 years ago
- Apfell implant written in C#.☆8Updated 4 years ago
- Includes 5 Known Application Whitelisting/ Application Control Bypass Techniques in One File.☆32Updated 8 years ago
- ☆28Updated 7 years ago
- ☆56Updated 5 years ago
- ☆17Updated 9 years ago
- Bloodhound Attack Path Automation in CobaltStrike☆30Updated 7 years ago
- few months old but better than nothing☆58Updated 3 years ago
- This tool is designed to simplify and automate the extraction and organization of useful data from Cobalt Strike logs.☆18Updated 6 years ago
- Impacket is a collection of Python classes for working with network protocols.☆17Updated 4 years ago
- Random source codes☆25Updated 4 years ago
- Code for blogpost: https://outflank.nl/blog/2018/10/25/building-resilient-c2-infrastructues-using-dns-over-https/☆52Updated 6 years ago