olafhartong / BamboozlEDRLinks
A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.
☆99Updated this week
Alternatives and similar repositories for BamboozlEDR
Users that are interested in BamboozlEDR are comparing it to the libraries listed below
Sorting:
- ☆157Updated 6 months ago
- Two in one, patch lifetime powershell console, no more etw and amsi!☆95Updated 3 months ago
- ☆155Updated 7 months ago
- Detect WFP filters blocking EDR communications☆93Updated last year
- ☆119Updated last year
- This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.☆89Updated 11 months ago
- Simple EDR that injects a DLL into a process to place a hook on specific Windows API☆95Updated last year
- ☆119Updated 4 years ago
- Easy to use, open-source infrastructure management platform, crafted specifically for red team engagements.☆84Updated this week
- ☆133Updated 6 months ago
- A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine.☆157Updated last year
- StoneKeeper C2, an experimental EDR evasion framework for research purposes☆206Updated 7 months ago
- IronSharpPack is a repo of popular C# projects that have been embedded into IronPython scripts that execute an AMSI bypass and then refle…☆115Updated last year
- Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…☆140Updated last year
- C# implementation of TokenFinder. Steal M365 access tokens from Office Desktop apps☆140Updated last year
- ForsHops☆145Updated 4 months ago
- A tool to transform Chromium browsers into a C2 Implant☆130Updated this week
- Detect EDR's exceptions by inspecting processes' loaded modules☆130Updated last year
- Tool for viewing NTDS.dit☆174Updated 4 months ago
- An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution☆190Updated 8 months ago
- A collection of various and sundry code snippets that leverage .NET dynamic tradecraft☆145Updated last year
- BloodHound PowerShell client☆58Updated last week
- WTSImpersonator utilizes WTSQueryUserToken to steal user tokens by abusing the RPC Named Pipe "\\pipe\LSM_API_service"☆119Updated last year
- Blog/Journal on how to backdoor VSCode extensions☆68Updated 3 weeks ago
- .NET Post-Exploitation Utility for Abusing Explicit Certificate Mappings in ADCS☆149Updated 6 months ago
- ☆83Updated last year
- AzureAD beacon object files☆121Updated 7 months ago
- Adversary Emulation Framework☆121Updated last month
- ☆89Updated 3 years ago
- comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reducti…☆204Updated last year