jconwell / secret_handshake
A prototype malware C2 channel using x509 certificates over mTLS
☆149Updated 10 months ago
Alternatives and similar repositories for secret_handshake:
Users that are interested in secret_handshake are comparing it to the libraries listed below
- A comprehensive workshop aimed to equip participants with an in-depth understanding of modern Command and Control (C2) concepts, focusing…☆98Updated last year
- ☆184Updated this week
- ☆110Updated 3 years ago
- ☆112Updated 11 months ago
- ☆185Updated 3 months ago
- ☆126Updated 6 months ago
- pysnaffler☆88Updated 2 weeks ago
- pyCobaltHound is an Aggressor script extension for Cobalt Strike which aims to provide a deep integration between Cobalt Strike and Blood…☆136Updated last year
- ☆219Updated last year
- ☆131Updated 5 months ago
- Resources linked to my presentation at OffensiveX in Athens in June 2024 on the topic "Breach the Gat, Advanced Initial Access in 2024"☆130Updated 5 months ago
- Malware As A Service☆120Updated 10 months ago
- The most average C2 ever (MACE)☆96Updated 2 years ago
- Identifies the bytes that Microsoft Defender flags on.☆78Updated 2 years ago
- ☆120Updated last year
- This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.☆76Updated 4 months ago
- Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…☆141Updated 5 months ago
- Living Off the Foreign Land setup scripts☆64Updated last week
- A suite of tools to disrupt campaigns using the Sliver C2 framework.☆251Updated last year
- Red Team "Drop and Run" NAC (802.1x) Bypass☆70Updated last year
- Koppeling x Metatwin x LazySign☆205Updated 3 years ago
- Hide shellcode by shuffling bytes into a random array and reconstruct at runtime☆183Updated 6 months ago
- Artificially inflate a given binary to exceed common EDR file size limits. Can be used to bypass common EDR.☆119Updated 2 years ago
- Cortex XDR Config Extractor☆130Updated last year
- A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.☆303Updated last year
- Simple tool to perform HTML Smuggling.☆66Updated 3 years ago
- POC for frustrating/defeating Malware Analysts☆155Updated 2 years ago
- Slide decks and/or materials from conference presentations☆55Updated 2 years ago
- ☆176Updated last month
- Some scripts to support with importing large datasets into BloodHound☆79Updated last year