WTF are these binaries doing?! A list of benign applications that mimic malicious behavior.
☆173Mar 30, 2025Updated last year
Alternatives and similar repositories for wtfbins
Users that are interested in wtfbins are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆27Feb 6, 2022Updated 4 years ago
- Proof-of-Concept to evade auditd by tampering via ptrace☆19Aug 3, 2023Updated 3 years ago
- BadExclusions is a tool to identify folder custom or undocumented exclusions on AV/EDR☆21Feb 8, 2024Updated 2 years ago
- This tool aims at parsing Microsoft Protection logs to provide relevant data to forensic analysts during incident responses.☆22Sep 30, 2022Updated 4 years ago
- ☆266May 9, 2024Updated 2 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Purple Team Resources for Enterprise Purple Teaming: An Exploratory Qualitative Study by Xena Olsen.☆681Jun 14, 2023Updated 3 years ago
- A simple PE loader.☆27Dec 9, 2022Updated 3 years ago
- ☆21May 8, 2022Updated 4 years ago
- Documentation and scripts to properly enable Windows event logs.☆724Oct 3, 2025Updated last year
- Repository of Microsoft Driver Block Lists based off of OS-builds☆45Apr 14, 2024Updated 2 years ago
- BOF for C2 framework☆45Nov 9, 2024Updated last year
- Using Microsoft 365 App Passwords for persistence☆23Sep 2, 2020Updated 6 years ago
- The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifa…☆667Oct 24, 2026Updated last week
- Rules generated from our investigations.☆214Jul 8, 2026Updated 3 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Notion as a platform for offensive operations☆1,172May 21, 2023Updated 3 years ago
- ☆239Jun 10, 2025Updated last year
- Using fibers to run in-memory code.☆247Oct 19, 2023Updated 3 years ago
- ☆91Jul 18, 2023Updated 3 years ago
- The cActiveDirectorySecurity module contains PowerShell Functions which are designed to report on and manipulate Access Control Lists on …☆11Aug 31, 2018Updated 8 years ago
- ☆20May 30, 2025Updated last year
- Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows…☆2,147Dec 11, 2024Updated last year
- Ludus roles to deploy ASR rules and MDI auditing settings☆25Aug 5, 2025Updated last year
- Parser and reconciliation tooling for large Active Directory environments.☆34Feb 18, 2025Updated last year
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- ☆383Aug 7, 2023Updated 3 years ago
- ☆105Oct 7, 2023Updated 3 years ago
- Purple Team Exercise Framework☆828Apr 9, 2026Updated 6 months ago
- Detect EDR's exceptions by inspecting processes' loaded modules☆133Mar 15, 2024Updated 2 years ago
- WptsExtensions.dll for exploiting DLL hijacking of the task scheduler.☆57Jun 30, 2021Updated 5 years ago
- This project aims to compare and evaluate the telemetry of various EDR products.☆1,998Updated this week
- GATOR - GCP Attack Toolkit for Offensive Research, a tool designed to aid in research and exploiting Google Cloud Environments☆90Jun 22, 2024Updated 2 years ago
- ☆32Feb 25, 2022Updated 4 years ago
- A tool for checking if MFA is enabled on multiple Microsoft Services☆1,715Apr 13, 2026Updated 6 months ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- Easy red team phishing with Puppeteer☆136Feb 6, 2023Updated 3 years ago
- An implementation and proof-of-concept of Process Forking.☆228Nov 29, 2021Updated 4 years ago
- A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.ht…☆676Dec 23, 2022Updated 3 years ago
- Production-ready Windows 10 & 11 Exploit Protection policy aligned with Microsoft Defender and DISA STIG baselines.☆13Oct 7, 2026Updated 3 weeks ago
- quASAR: ASAR manipulation made easy☆38Sep 7, 2022Updated 4 years ago
- ☆122Jan 30, 2024Updated 2 years ago
- Automatically perform advanced NTLM hash relay attacks☆15Nov 4, 2022Updated 3 years ago