hackerhouse-opensource / WMIProcessWatcher
A CIA tradecraft technique to asynchronously detect when a process is created using WMI.
☆131Updated 10 months ago
Related projects ⓘ
Alternatives and complementary repositories for WMIProcessWatcher
- ☆98Updated 3 weeks ago
- CIA UAC bypass implementation that utilizes elevated COM object to write to System32 and an auto-elevated process to execute as administr…☆174Updated 10 months ago
- ☆103Updated 4 months ago
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆325Updated 5 months ago
- A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.☆301Updated last year
- Tools for analyzing EDR agents☆209Updated 5 months ago
- Offensive Lua.☆175Updated last year
- Analyse MSI files for vulnerabilities☆109Updated 2 months ago
- Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…☆139Updated 3 months ago
- ☆153Updated 6 months ago
- Exploitation of process killer drivers☆188Updated last year
- ☆181Updated 9 months ago
- ☆105Updated 9 months ago
- DLL proxying for lazy people☆136Updated 2 weeks ago
- ☆105Updated last year
- early cascade injection PoC based on Outflanks blog post☆160Updated 2 weeks ago
- comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reducti…☆190Updated 5 months ago
- Recursive Loader☆102Updated last month
- PoC for using MS Windows printers for persistence / command and control via Internet Printing☆143Updated 6 months ago
- ☆95Updated 2 months ago
- A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue☆95Updated 7 months ago
- Implementing the ghostly hollowing PE injection technique using tampered syscalls.☆125Updated 5 months ago
- ☆124Updated 3 weeks ago
- This project is an implant framework designed for long term persistent access to Windows machines.☆110Updated last year
- ☆129Updated last month
- Admin to Kernel code execution using the KSecDD driver☆236Updated 7 months ago
- Hide your P/Invoke signatures through other people's signed assemblies☆202Updated 8 months ago
- ☆126Updated 3 months ago
- Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…☆209Updated 2 months ago
- Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io☆79Updated 9 months ago