DfirJos / CnC-detectionLinks
Detecting PowerShell Empire, Metasploit Meterpreter and Cobalt Strike agents by payload size sequence analysis and host correlation
☆16Updated 6 years ago
Alternatives and similar repositories for CnC-detection
Users that are interested in CnC-detection are comparing it to the libraries listed below
Sorting:
- Bash one-liner that will parse harmj0y's SharpRoast or Rebeus kerberoast into hashcat crack-able format.☆32Updated 6 years ago
- Community maintained list of most popular HIPS service and process names on a Windows Platform.☆43Updated 2 years ago
- Random source codes☆25Updated 5 years ago
- Babel-Shellfish deobfuscates and scans Powershell scripts on real-time right before each line execution.☆43Updated 6 years ago
- Code for blogpost: https://outflank.nl/blog/2018/10/25/building-resilient-c2-infrastructues-using-dns-over-https/☆52Updated 6 years ago
- Presentation materials for talks I've given.☆20Updated 5 years ago
- Cobalt Strike log state tracking, parsing, and storage☆24Updated 5 years ago
- BloodHound Cypher Queries Ported to a Jupyter Notebook☆53Updated 5 years ago
- Includes 5 Known Application Whitelisting/ Application Control Bypass Techniques in One File.☆32Updated 8 years ago
- The project is called GreatSCT (Great Scott). GreatSCT is an open source project to generate application white list bypasses. This tool i…☆30Updated 7 years ago
- ☆13Updated 4 years ago
- Everything related to Cobalt Strike☆15Updated 5 years ago
- Helper script for mangling CS payloads☆51Updated 6 years ago
- .net tool that uses WMI queries to enumerate active sessions and accounts configured to run services on remote systems☆33Updated 5 years ago
- Powershell script which will take any payload and put it in the a bat script which delivers the payload. The payload is delivered using e…☆53Updated last year
- Ingests logs/dbs from cobalt and empire and outputs an excel report with activity, sessions, and credentials☆20Updated 4 years ago
- Discover MSSQL Instances via UDP Scanning☆25Updated 6 years ago
- ☆45Updated 6 years ago
- Microsoft Applocker evasion tool☆39Updated 5 years ago
- A collection of shell code conversion scripts that I have written over time for repetitive tasks☆19Updated 5 years ago
- SilkETW & SilkService☆40Updated 5 years ago
- Exercises for C# Workshop at Wild West Hackin' Fest 2018 & 2019.☆64Updated 5 years ago
- ☆25Updated 6 years ago
- My musings with C#☆28Updated 2 years ago
- Tweettioc Splunk App☆20Updated 4 years ago
- ☆12Updated 7 years ago
- Convert Empire profiles to Apache mod_rewrite scripts☆28Updated 5 years ago
- ☆17Updated 9 years ago
- ☆54Updated 6 years ago
- Use bitsadmin to maintain persistence and bypass Autoruns☆66Updated 7 years ago