This repository aims to collect and document indicators from the different C2's listed in the C2-Matrix
☆74Jan 26, 2022Updated 4 years ago
Alternatives and similar repositories for C2-Matrix-Indicators
Users that are interested in C2-Matrix-Indicators are comparing it to the libraries listed below
Sorting:
- ☆33Feb 26, 2022Updated 4 years ago
- Pointer was developed for massive hunting and mapping Cobalt Strike servers exposed on the internet.☆69Apr 12, 2022Updated 3 years ago
- A list of JARM hashes for different ssl implementations used by some C2/red team tools.☆144Apr 20, 2023Updated 2 years ago
- Implementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.☆208Jul 21, 2022Updated 3 years ago
- A collection of sample code used in some experiments with Sliver C2☆16Mar 28, 2023Updated 2 years ago
- Collection of tools that reflect the network dimension into Bloodhound's data☆446Oct 19, 2022Updated 3 years ago
- Notification webhook for GoPhish☆57Jun 10, 2024Updated last year
- Citrix Phishlet☆24Feb 2, 2021Updated 5 years ago
- The Threat Hunting In Rapid Iterations (THIRI) Jupyter notebook is designed as a research aide to let you rapidly prototype threat huntin…☆154Apr 25, 2022Updated 3 years ago
- This is a repo for fetching Applocker event log by parsing the win-event log☆31Aug 6, 2022Updated 3 years ago
- Tools related to work with Attack Flow (https://github.com/center-for-threat-informed-defense/attack-flow)☆44Jun 6, 2022Updated 3 years ago
- WMEye is a post exploitation tool that uses WMI Event Filter and MSBuild Execution for lateral movement☆369Dec 24, 2021Updated 4 years ago
- Threat Box Assessment Tool☆19Aug 15, 2021Updated 4 years ago
- How to set up a local copy of Have-I-Been-Pwned's password checking service☆21Aug 19, 2021Updated 4 years ago
- ☆50Jun 28, 2022Updated 3 years ago
- A post-exploitation strategy for persistence and egress from networks utilizing authenticated web proxies☆34Sep 15, 2022Updated 3 years ago
- Create a cool process tree like https://twitter.com/ACEResponder.☆35Mar 1, 2023Updated 3 years ago
- ☆20Feb 22, 2021Updated 5 years ago
- Playing with PE's and Building Structures by Hand☆22Apr 21, 2022Updated 3 years ago
- Pure C++, weaponized, fully automated implementation of RottenPotatoNG☆313Sep 16, 2021Updated 4 years ago
- Cobalt Strike Beacon Object File (BOF) that uses handwritten shellcode to return the process Environment strings without touching any DLL…☆183Mar 13, 2023Updated 2 years ago
- A repository that maps API calls to Sysmon Event ID's.☆121Nov 14, 2022Updated 3 years ago
- A parser of Windows Defender's DetectionHistory forensic artifact, containing substantial info about quarantined files and executables.☆117Jan 26, 2022Updated 4 years ago
- C# utility that uses WMI to run "cmd.exe /c netstat -n", save the output to a file, then use SMB to read and delete the file remotely☆38Jan 3, 2020Updated 6 years ago
- A Model Context Protocol (MCP) server to converse with data in Bloodhound☆60Updated this week
- DoppelGate relies on reading ntdll on disk to grab syscall stubs, and patches these syscall stubs into desired functions to bypass Userla…☆123Mar 25, 2022Updated 3 years ago
- Detection Ideas & Rules repository.☆178Sep 10, 2021Updated 4 years ago
- Cloud, CDN, and marketing services leveraged by cybercriminals and APT groups☆60Oct 28, 2022Updated 3 years ago
- ☆19Jan 31, 2025Updated last year
- Microsoft 365 Defender Hunting via PowerShell.☆14Feb 8, 2022Updated 4 years ago
- Execute Mimikatz with different technique☆51Nov 8, 2021Updated 4 years ago
- This is a repository for reporting any issues in any of my software☆13May 15, 2018Updated 7 years ago
- A dataset of phishing kits in the wild☆15Jun 1, 2024Updated last year
- Tricks the target into enabling content (macros) with fake messages. Once enabled, uses macros to reduce the risk of suspision from targe…☆172Mar 12, 2025Updated 11 months ago
- DLL Hijack Search Order Enumeration BOF☆149Nov 3, 2021Updated 4 years ago
- Apply a filter to the events being reported by windows event logging☆262Apr 24, 2021Updated 4 years ago
- Aims to identify sleeping beacons☆662Jan 25, 2026Updated last month
- ☆61Aug 30, 2021Updated 4 years ago
- Artificially inflate a given binary to exceed common EDR file size limits. Can be used to bypass common EDR.☆125Apr 9, 2022Updated 3 years ago