Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK.
☆28Oct 14, 2026Updated this week
Alternatives and similar repositories for Sentinel
Users that are interested in Sentinel are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A technique that mixes NTDLL unhooking and hellsgate gate varients☆33Updated this week
- Automated adversary emulation (Caldera) against an AD lab to validate Sigma detection coverage and map results to MITRE ATT&CK.☆54Sep 25, 2026Updated 3 weeks ago
- Application-scoped Windows network brownouts in native C and BOF form☆23Aug 18, 2026Updated 2 months ago
- ☆49Oct 4, 2026Updated 2 weeks ago
- Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.☆108Oct 1, 2026Updated 2 weeks ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- A Purple Team lab simulating Active Directory attacks (Kerberoasting, BloodHound, lateral movement) and implementing defensive hardening …☆37Oct 7, 2026Updated last week
- CVE-85884 POC☆33Updated this week
- A poor man's attempt to replicate the shellcode execution technique demo'd by @3lk during STHACK 2026 (https://www.youtube.com/watch?v=al…☆24Updated this week
- CnaEmulator is a standalone, general-purpose development, emulation, and testing harness for Cobalt Strike Aggressor Scripts (.cna)☆23Sep 20, 2026Updated 3 weeks ago
- Windows x64 API hashing library that bypasses EAF and resolves forwarded exports, ordinals, and api-ms-*/ext-ms-* API Set DLLs.☆63Oct 7, 2026Updated last week
- Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender.☆28Jul 14, 2026Updated 3 months ago
- An AI CTF challenges to learn some of the risks that AI Chatbots pose☆77Sep 20, 2026Updated 3 weeks ago
- Process Impairment Exploit Chain.☆36Aug 12, 2026Updated 2 months ago
- IP obfuscation and URL generator.☆48Dec 8, 2025Updated 10 months ago
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- Enumerate user accounts and registered authentication methods via the Microsoft Self-Service Password Reset (SSPR) portal☆57Sep 15, 2026Updated last month
- Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opport…☆38Oct 1, 2026Updated 2 weeks ago
- OneDrive as a covert C2 transport for Cobalt Strike☆77Sep 19, 2026Updated 3 weeks ago
- One-pass anonymous Active Directory enumeration over SAMR and LSARPC — null session, no credentials, with structured reusable output.☆69Sep 17, 2026Updated last month
- AI red-teaming tool and LLM security framework to evaluate agentic AI applications. Tests prompt injections, handles vulnerability assess…☆64Updated this week
- A Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes.☆31Aug 12, 2026Updated 2 months ago
- ☆45Updated this week
- A collection of techniques for process injection on Windows☆104Aug 16, 2026Updated 2 months ago
- Modular post-exploitation framework for authorised red-team work. Interactive reverse/bind shells over TCP/TLS/mTLS, plus a pull-based Go…☆37Oct 7, 2026Updated last week
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- Token Analysis and Tracking System☆45Aug 25, 2026Updated last month
- A stealth-focused kernel-mode virtual HID mouse driver for Windows. Built with KMDF and VHF for precise, hardware-level input simulation …☆49Jul 27, 2026Updated 2 months ago
- POC tool for ResetNightmare (CVE-2026-27912)☆224Aug 20, 2026Updated last month
- A concept of using a ROP chain paired with a WRMSR primitive to call kernel functions and map unsigned drivers through BYOVD (AmdTools64.…☆67Sep 21, 2026Updated 3 weeks ago
- Proof-of-concept exploit chain (CVE-2026-47301) for Microsoft Configuration Manager (SCCM), combining a broken access, CAB arbitrary-writ…☆108Aug 16, 2026Updated 2 months ago
- Security-first AI-native C5 teamserver (Command · Control · Cognitive · Collaborative · Coordination) for authorized red team & pentest. …☆57Sep 25, 2026Updated 3 weeks ago
- PoC for WinNotify, demonstrated through a driver mapper, and local privilege escalation.☆40Sep 20, 2026Updated 3 weeks ago
- Raw NTFS volume oracle: locked-file read and offline SAM hashes without LSASS☆62Jul 22, 2026Updated 2 months ago
- Pass-the-Passkey Family of Attacks☆233Sep 14, 2026Updated last month
- Simple, predictable pricing with DigitalOcean hosting • AdAlways know what you'll pay with monthly caps and flat pricing. Enterprise-grade infrastructure trusted by 600k+ customers.
- Proof of Concept for Process Code Injection Without Using WriteProcessMemory☆151Sep 27, 2026Updated 3 weeks ago
- another PrivEsc potato...☆120Sep 5, 2026Updated last month
- CVE-2026-50343 InstallService StaticPluginMap EoP - standard user to SYSTEM☆48Jul 16, 2026Updated 3 months ago
- Build guide for Red Teaming home lab. GOAD lab setup in Proxmox and pfSense, Operator/C2 and Redirectors.☆48Sep 26, 2026Updated 3 weeks ago
- Silverseal is an open-source Linux bootkit and rootkit framework written in Rust, using UEFI and early kernel boot hooks to load a stealt…☆172Oct 8, 2026Updated last week
- A canvas for red team infrastructure and cyber ranges. Compose a topology, export runnable Terraform and Ansible, and deploy it yourself.…☆164Oct 6, 2026Updated last week
- Tool to authenticate to an LDAP/S server with a certificate through Schannel written in Rust. 🦀☆77Oct 10, 2026Updated last week