mgeeky / msidump
MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.
☆193Updated last year
Related projects ⓘ
Alternatives and complementary repositories for msidump
- Finding secrets in kernel and user memory☆113Updated last year
- A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!☆317Updated 3 months ago
- Evasion Escaper is a project aimed at evading the checks that malicious software performs to detect if it's running in a virtual environm…☆99Updated last year
- ShellWasp is a tool to help build shellcode that utilizes Windows syscalls, while overcoming the portability problem associated with Wind…☆159Updated last year
- A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.☆300Updated last year
- Python library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles☆146Updated 3 weeks ago
- A ProcessMonitor visualization application written in rust.☆176Updated last year
- Weaponizing to get NT SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting☆358Updated last year
- POC for frustrating/defeating Malware Analysts☆149Updated 2 years ago
- Tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows☆197Updated 2 years ago
- Aims to identify sleeping beacons☆488Updated 4 months ago
- ☆181Updated last year
- Tools for analyzing EDR agents☆208Updated 4 months ago
- A collection of tools and detections for the Sliver C2 Frameworj☆109Updated last year
- Tools and PoCs for Windows syscall investigation.☆354Updated 6 months ago
- EDRSandblast-GodFault☆240Updated last year
- A Stealthy Lsass Dumper - can abuse ProcExp152.sys driver to dump PPL Lsass, no dbghelp.lib calls.☆313Updated last year
- RIPPL is a tool that abuses a usermode only exploit to manipulate PPL processes on Windows☆6Updated 2 years ago
- An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…☆109Updated 3 months ago
- Detect strange memory regions and DLLs☆168Updated 2 years ago
- ETW based POC to identify direct and indirect syscalls☆172Updated last year
- A small program written in C that is designed to load 32/64-bit shellcode and allow for execution or debugging. Can also output PE files …☆124Updated 3 months ago
- ☆111Updated 2 years ago
- Leaked Windows processes handles identification tool☆272Updated 2 years ago
- Simple EDR implementation to demonstrate bypass☆159Updated 4 years ago
- Run Your Payload Without Running Your Payload☆176Updated 2 years ago
- A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC☆346Updated 2 years ago
- Lockbit3.0 Microsoft Defender MpClient.dll DLL Hijacking PoC☆170Updated 2 years ago
- ☆90Updated last year