t0-retooling / defender-recon24

Related projects ⓘ

Alternatives and complementary repositories for defender-recon24

• jbaines-r7 / dellicious
  Enabled / Disable LSA Protection via BYOVD
  ☆62Updated 2 years ago
• trailofbits / WinDbg-JS
  ☆24Updated last year
• ommadawn46 / HEVD-BufferOverflowNonPagedPoolNx-Win10-22H2
  HEVD Exploit: BufferOverflowNonPagedPoolNx on Windows 10 22H2 - Escalating from Low Integrity to SYSTEM via Aligned Chunk Confusion
  ☆39Updated 3 months ago
• elastic / PPLGuard
  ☆67Updated last year
• jdu2600 / Etw-SyscallMonitor
  Monitors ETW for security relevant syscalls maintaining the set called by each unique process
  ☆49Updated last year
• boku7 / x64win-DynamicNoNull-WinExec-PopCalc-Shellcode
  64bit WIndows 10 shellcode dat pops dat calc - Dynamic & Null Free
  ☆58Updated last year
• MMitsuha / Tajimari
  the Open Source and Pure C++ Packer for eXecutables
  ☆18Updated last year
• FuzzySecurity / BulkBindex
  Winbindex bot to pull in binaries for specific releases
  ☆46Updated last year
• Crypt0s / Ekko_CFG_Bypass
  A PoC for adding NtContinue to CFG allowed list in order to make Ekko work in a CFG protected process
  ☆87Updated 2 years ago
• rbmm / RtlClone
  ☆27Updated 4 months ago
• bananabr / Givemeahand
  A PoC tool for exploiting leaked process and thread handles
  ☆30Updated 9 months ago
• farinap5 / bitmap4shell
  A (quite) simple steganography algorithm to hide shellcodes within bitmap image.
  ☆21Updated 6 months ago
• yamakadi / ldr
  A work in progress BOF/COFF loader in Rust
  ☆45Updated last year
• zeze-zeze / HITCON-2023-Demo-CVE-2023-20562
  ☆57Updated last year
• ASkyeye / CVE-2018-19320
  Exploiting ring0 memcpy-like functionality to disable Driver Signing Enforcement (DSE)
  ☆20Updated 4 years ago
• GetRektBoy724 / SyscallShuffler
  Your NTDLL vaccine from modern direct syscall methods.
  ☆35Updated 2 years ago
• hasherezade / shellc_encoder
  Standalone Metasploit-like XOR encoder for shellcode
  ☆46Updated 6 months ago
• RomanRybachek / CVE-2024-20698
  Analysis of the vulnerability
  ☆47Updated 10 months ago
• airbus-cert / ttd2mdmp
  Extract data of TTD trace file to a minidump
  ☆28Updated last year
• Dump-GUY / Get-PDInvokeImports
  Get-PDInvokeImports is tool (PowerShell module) which is able to perform automatic detection of P/Invoke, Dynamic P/Invoke and D/Invoke u…
  ☆51Updated 2 years ago
• Meowmycks / etwunhook
  Simple ETW unhook PoC. Overwrites NtTraceEvent opcode to disable ETW at Nt-function level.
  ☆42Updated 8 months ago
• varwara / CVE-2024-21338
  PoC for the Untrusted Pointer Dereference in the appid.sys driver
  ☆13Updated 7 months ago
• xpn / ObjectOverloadingPOC
  ☆58Updated 2 years ago
• hongson11698 / defender-database-extract
  defender_database
  ☆17Updated last year
• Dump-GUY / sc2pe
  Simple dotnet Native AOT app that uses AsmResolver to convert shellcode to PE
  ☆64Updated last year
• SpiralBL0CK / CVE-2024-40431-CVE-2022-25479-EOP-CHAIN
  CVE-2024-40431+CVE-2022-25479 chain for EOP(DATA ONLY ATTACK)
  ☆45Updated last month
• roadwy / SIGNATURE_TYPE_LUASTANDALONE
  Extracted lua script from Defender mpavbase.vdm and mpasbase.vdm
  ☆12Updated 4 months ago
• ihack4falafel / ROR13HashGenerator
  C# implementation to produce ROR-13 numeric hash for given function API name
  ☆31Updated 5 years ago