Alternatives and similar repositories for SliverC2-Forensics

Users that are interested in SliverC2-Forensics are comparing it to the libraries listed below

• amjcyber / EDRNoiseMaker
  Detect WFP filters blocking EDR communications
  ☆96Updated 2 years ago
• mgeeky / msidump
  MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.
  ☆224Updated 2 years ago
• paranoidninja / Cobaltstrike-Detection
  This repo will contain the core detection, only for Cobaltstrike's leaked versions. Non-leaked version detections wont be shared
  ☆89Updated 2 years ago
• ElJaviLuki / CobaltStrike_OpenBeacon
  Fully functional, from-scratch alternative to the Cobalt Strike Beacon (red teaming tool), offering transparency and flexibility for secu…
  ☆258Updated last year
• flostyen / windows-persistence
  Windows Persistence IT-Security
  ☆108Updated 10 months ago
• volexity / donut-decryptor
  Retrieve inner payloads from Donut samples
  ☆116Updated last month
• ACE-Responder / RogueSliver
  A suite of tools to disrupt campaigns using the Sliver C2 framework.
  ☆280Updated 2 years ago
• itaymigdal / LOLSpoof
  An interactive shell to spoof some LOLBins command line
  ☆187Updated last year
• daddycocoaman / dumpscan
  Finding secrets in kernel and user memory
  ☆116Updated 2 years ago
• ZeroMemoryEx / C2-Hunter
  Extract C2 Traffic
  ☆251Updated last year
• TierZeroSecurity / edr_blocker
  Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…
  ☆139Updated last year
• Diverto / IPPrintC2
  PoC for using MS Windows printers for persistence / command and control via Internet Printing
  ☆149Updated last year
• forensicxlab / VISION-ProcMon
  A ProcessMonitor visualization application written in rust.
  ☆183Updated 2 years ago
• IncludeSecurity / c2-vulnerabilities
  PoCs of RCEs against open source C2 servers
  ☆89Updated last year
• floesen / EventLogCrasher
  ☆192Updated last year
• arosenmund / defcon33_silence_kill_edr
  ☆332Updated 4 months ago
• Wh04m1001 / SysmonEoP
  ☆184Updated 3 years ago
• deepinstinct / ContainYourself
  A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.
  ☆319Updated 2 years ago
• QueenSquishy / plague
  Default Detections for EDR
  ☆97Updated last year
• RussianPanda95 / Configuration_extractors
  Configuration Extractors for Malware
  ☆122Updated 8 months ago
• StrikeReady-Inc / samples
  shared samples from #dailyphish and/or #apt tweets
  ☆41Updated 4 months ago
• jstrosch / sclauncher
  A small program written in C that is designed to load 32/64-bit shellcode and allow for execution or debugging. Can also output PE files …
  ☆167Updated last year
• lolc2 / lolc2.github.io
  lolC2 is a collection of C2 frameworks that leverage legitimate services to evade detection
  ☆252Updated 7 months ago
• oh-az / NoArgs
  NoArgs is a tool designed to dynamically spoof and conceal process arguments while staying undetected. It achieves this by hooking into W…
  ☆155Updated last year
• sensepost / mydumbedr
  ☆121Updated last year
• LOLESXi-Project / LOLESXi
  LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. T…
  ☆143Updated last month
• olafhartong / BamboozlEDR
  A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.
  ☆252Updated 3 months ago
• SafeBreach-Labs / aikido_wiper
  ☆68Updated 3 years ago
• SafeBreach-Labs / wd-pretender
  ☆132Updated 2 years ago
• fox-it / dissect.cobaltstrike
  Python library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles
  ☆183Updated 6 months ago