mandiant / msi-searchLinks
☆282Updated last year
Alternatives and similar repositories for msi-search
Users that are interested in msi-search are comparing it to the libraries listed below
Sorting:
- Extracting NetNTLM without touching lsass.exe☆238Updated last year
- Kill AV/EDR leveraging BYOVD attack☆361Updated last year
- comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reducti…☆201Updated last year
- Open Source C&C Specification☆260Updated 3 months ago
- This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone…☆201Updated 8 months ago
- PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.☆420Updated last year
- psexecsvc - a python implementation of PSExec's native service implementation☆202Updated 4 months ago
- Leak of any user's NetNTLM hash. Fixed in KB5040434☆255Updated 10 months ago
- PoC module to demonstrate automated lateral movement with the Havoc C2 framework.☆303Updated last year
- Different methods to get current username without using whoami☆177Updated last year
- ☆189Updated last year
- A Rust implementation of Internal-Monologue — retrieving NetNTLM hashes without touching LSASS, leveraging SSPI for NTLM negotiation and …☆166Updated last month
- Freeze.rs is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls written in RUST☆185Updated 9 months ago
- GregsBestFriend process injection code created from the White Knight Labs Offensive Development course☆193Updated 2 years ago
- ☆178Updated last week
- ☆305Updated last year
- Python implementation of GhostPack's Seatbelt situational awareness tool☆260Updated 7 months ago
- ☆221Updated last year
- A suite of tools to disrupt campaigns using the Sliver C2 framework.☆276Updated last year
- Amsi Bypass payload that works on Windwos 11☆378Updated last year
- 「💀」Proof of concept on BYOVD attack☆161Updated 6 months ago
- Lateral Movement Using DCOM and DLL Hijacking☆294Updated 2 years ago
- Bypass Credential Guard by patching WDigest.dll using only NTAPI functions☆242Updated 2 months ago
- PoC for using MS Windows printers for persistence / command and control via Internet Printing☆147Updated last year
- The GPOddity project, aiming at automating GPO attack vectors through NTLM relaying (and more).☆310Updated 7 months ago
- Impacket is a collection of Python classes for working with network protocols.☆283Updated 5 months ago
- Ghosting-AMSI☆191Updated 2 months ago
- BOF and Python3 implementation of technique to unbind 445/tcp on Windows via SCM interactions☆305Updated 7 months ago
- Various resources to enhance Cobalt Strike's functionality and its ability to evade antivirus/EDR detection☆296Updated last year
- A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!☆331Updated 11 months ago