MatheuZSecurity / detect-lkm-rootkit-cheatsheet
Cheat sheet to detect and remove linux kernel rootkit
☆57Updated 4 months ago
Alternatives and similar repositories for detect-lkm-rootkit-cheatsheet:
Users that are interested in detect-lkm-rootkit-cheatsheet are comparing it to the libraries listed below
- A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue☆98Updated last year
- ☆37Updated last year
- POC of GITHUB simple C2 in rust☆53Updated 3 months ago
- Make an Linux Kernel rootkit visible again.☆51Updated 2 months ago
- Lena's scripts/code/resources for malware analysis☆26Updated 10 months ago
- Windows Persistence IT-Security☆97Updated last month
- Collection of codes focused on Linux rootkits☆107Updated 2 months ago
- This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.☆78Updated 8 months ago
- Malware Analysis tools☆26Updated 7 months ago
- ☆37Updated 4 months ago
- Monarch - The Adversary Emulation Toolkit☆62Updated 4 months ago
- ☆105Updated 6 months ago
- Scan files for potential threats while leveraging AMSI (Antimalware Scan Interface) and Windows Defender. By isolating malicious content.☆16Updated 4 months ago
- Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …☆103Updated last month
- Deploy a phishing infrastructure on the fly.☆68Updated 4 months ago
- ☆80Updated 5 months ago
- ☆18Updated last month
- Local & remote Windows DLL Proxying☆164Updated 10 months ago
- Example code samples from our ScriptBlock Smuggling Blog post☆90Updated 10 months ago
- ☆69Updated last year
- ☆119Updated last year
- ☆154Updated 4 months ago
- A red teaming attack paradigm against AI Agents☆29Updated last month
- Hollowise is a tool that implements process hollowing and PPID (Parent Process ID) spoofing techniques for masking a legitimate analysis …☆36Updated 2 months ago
- Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.☆92Updated last week
- ☆77Updated last year
- Situational Awareness script to identify how and where to run implants☆50Updated 5 months ago
- ☆38Updated 2 years ago
- A tool to Impersonate logged on users without touching LSASS (Including non-Interactive sessions).☆93Updated 2 years ago
- Slides for COM Hijacking AV/EDR Talk on 38c3☆73Updated 4 months ago