t0-retooling / defender-recon24
☆49Updated 3 months ago
Alternatives and similar repositories for defender-recon24:
Users that are interested in defender-recon24 are comparing it to the libraries listed below
- LPE exploit for CVE-2023-36802☆23Updated last year
- Monitors ETW for security relevant syscalls maintaining the set called by each unique process☆70Updated last year
- Analysis of the vulnerability☆48Updated last year
- A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue☆96Updated 9 months ago
- An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…☆115Updated 6 months ago
- Convert Microsoft Defender Antivirus Signatures (VDM) into YARA rules☆36Updated this week
- Minifilter Callback Patching Proof-of-Concept☆64Updated 2 years ago
- 64bit WIndows 10 shellcode dat pops dat calc - Dynamic & Null Free☆60Updated last year
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆122Updated 2 years ago
- Report and exploit of CVE-2023-36427☆89Updated last year
- Windows AppLocker Driver (appid.sys) LPE☆47Updated 6 months ago
- HEVD Exploit: BufferOverflowNonPagedPoolNx on Windows 10 22H2 - Escalating from Low Integrity to SYSTEM via Aligned Chunk Confusion☆46Updated 2 weeks ago
- Walks the CFG bitmap to find previously executable but currently hidden shellcode regions☆109Updated last year
- CVE-2024-30090 - LPE PoC☆103Updated 3 months ago
- ☆132Updated 2 years ago
- Enabled / Disable LSA Protection via BYOVD☆65Updated 3 years ago
- XOR decrypting shellcode using the GPU with OpenCL.☆92Updated last year
- Winbindex bot to pull in binaries for specific releases☆46Updated last year
- A Poc on blocking Procmon from monitoring network events☆100Updated 2 years ago
- A C++ PoC implementation for enumerating Windows Fibers directly from memory☆17Updated 8 months ago
- ☆110Updated 2 years ago
- A improved memory obfuscation primitive using a combination of special and 'normal' Asynchronous Procedural Calls☆105Updated 4 months ago
- Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)☆95Updated last year
- ☆63Updated 2 years ago
- Finding Truth in the Shadows☆88Updated 2 years ago
- This repository contains an IDA processor for loading and disassembling compiled yara rules.☆33Updated 3 weeks ago
- ☆71Updated 6 months ago
- ☆85Updated 2 years ago
- Slides for COM Hijacking AV/EDR Talk on 38c3☆68Updated 3 weeks ago
- Reimplementation of the KExecDD DSE bypass technique.☆45Updated 4 months ago