Technical documentation, reverse engineering research, and tools for the Windows Endpoint Security Platform (WESP).
☆83Sep 18, 2026Updated last month
Alternatives and similar repositories for wesp-research
Users that are interested in wesp-research are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Windows AppResolver LPE PoC with a filtered-admin-to-SYSTEM demonstration☆15Jul 17, 2026Updated 3 months ago
- Hypervisor isolated shellcode execution environment. Maps host process memory into a guest vCPU, intercepts DLL execute faults, and proxi…☆58Updated this week
- Autonomous Windows POC developer from patchwatch diff reports☆160Jul 30, 2026Updated 3 months ago
- Clean Indirect Syscalls with Syscall Tampering.☆51Oct 25, 2026Updated last week
- A local tool for ingesting Windows Patch Tuesday CVEs, diffing patched binaries with Ghidriff and surfacing LLM-generated security analys…☆83Jul 31, 2026Updated 3 months ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Demonstration of the DLL party process injection technique☆99Oct 1, 2026Updated last month
- ☆72Jul 12, 2026Updated 3 months ago
- various methods of making API calls☆19Feb 1, 2025Updated last year
- ☆25Oct 27, 2026Updated last week
- Audiodg.exe DLL hijacking for LPE with reboot-free restart primitive. Executes code as LOCAL SERVICE, escalates to SYSTEM via Scheduled T…☆129Jan 24, 2026Updated 9 months ago
- Cuban Eight is a red team tool that packages a Windows PE payload into a .wsl file spoofing a real Linux distro installer. Double-click t…☆33Oct 16, 2026Updated 3 weeks ago
- macOS Container Payload Wrapper☆23Mar 13, 2026Updated 7 months ago
- A compiled language for Windows position-independent x86-64 shellcode and Beacon Object Files.☆322Jun 28, 2026Updated 4 months ago
- Proof of Concept for Process Code Injection Without Using WriteProcessMemory☆160Sep 27, 2026Updated last month
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Reverse engineering and live validation of the Windows Endpoint Security Platform preview☆19Sep 11, 2026Updated last month
- Atomic test units for BOF execution☆62Apr 26, 2026Updated 6 months ago
- Usermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more.☆91Jun 15, 2026Updated 4 months ago
- ☆69Oct 27, 2026Updated last week
- Shellcode injection using the Windows Debugging API☆185Jan 4, 2026Updated 10 months ago
- Offensive PoC tool for BTR.sys - Microsoft Defender's Boot Time Removal Tool. Supporting material for the BTR Reforged research (Black Ha…☆148Aug 20, 2026Updated 2 months ago
- DCOM in memory and fileless lateral movement techniques through .Net deserilization☆296Jun 22, 2026Updated 4 months ago
- Process Impairment Exploit Chain.☆36Aug 12, 2026Updated 2 months ago
- LPE Proof-of-Concept for Windows 11 abusing TrustedInstaller's Component Based Servicing (CBS) session COM object and junctions for arbit…☆58Updated this week
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- User-mode ETW interception and telemetry manipulation lab for Windows security research.☆43Oct 22, 2026Updated 2 weeks ago
- A community maintained repository of Beacon Object Files (BOFs) for red team operations, research, and education. Our goal is to provide …☆34Aug 8, 2026Updated 2 months ago
- Process ID Mutator via BYOVD Kernel R/W☆22Sep 6, 2026Updated 2 months ago
- A BOF designed to inspect processes memory and addresses☆43Apr 19, 2026Updated 6 months ago
- A poor man's attempt to replicate the shellcode execution technique demo'd by @3lk during STHACK 2026 (https://www.youtube.com/watch?v=al…☆40Oct 14, 2026Updated 3 weeks ago
- BOF and research notes from hunting execution paths, covering Shell.HWEventHandlerShellExecute COM execution through the AutoPlay IHWEven…☆39Jun 20, 2026Updated 4 months ago
- A concept of using a ROP chain paired with a WRMSR primitive to call kernel functions and map unsigned drivers through BYOVD (AmdTools64.…☆69Sep 21, 2026Updated last month
- Memory API proxy via signed mozglue.dll☆41Jun 25, 2026Updated 4 months ago
- Experimentations with the MSBuild Capabilites in a default environment.☆24Dec 6, 2025Updated 11 months ago
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- Windows native ETW inspection suite for browsing providers, reading metadata, consuming live events, recording ETL traces, filtering resu…☆113Oct 2, 2026Updated last month
- Intel 64/Windows low-level experiments☆119Sep 16, 2026Updated last month
- OneDrive as a covert C2 transport for Cobalt Strike☆79Sep 19, 2026Updated last month
- Windows Kernel-Mode Shellcode Development Framework (WKMSDF)☆91Aug 1, 2026Updated 3 months ago
- Kernel Information Disclosure☆35Jan 13, 2026Updated 9 months ago
- Async BOF to capture KeePass master passwords by detecting and keylogging locked database windows.☆51Jul 23, 2026Updated 3 months ago
- A foundational C library for building operationally credible offensive capabilities☆95Sep 21, 2026Updated last month