tyranid / windows-security-internals
A repository for additional files related to the book Windows Security Internals with PowerShell from No Starch Press.
☆128Updated 7 months ago
Related projects ⓘ
Alternatives and complementary repositories for windows-security-internals
- A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.☆300Updated last year
- ☆103Updated 4 months ago
- ROP ROCKET is an advanced code-reuse attack framework, with extensive ROP chain generation capabilities, including for novel Windows Sysc…☆111Updated 2 months ago
- ☆172Updated last year
- Weaponizing to get NT SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting☆358Updated last year
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆324Updated 5 months ago
- ☆293Updated 2 weeks ago
- ☆140Updated 3 months ago
- Slides & Code snippets for a workshop held @ x33fcon 2024☆236Updated 4 months ago
- A Visual Studio template used to create Cobalt Strike BOFs☆282Updated 2 years ago
- Lateral Movement Using DCOM and DLL Hijacking☆279Updated last year
- Tools for analyzing EDR agents☆208Updated 5 months ago
- ☆104Updated 9 months ago
- ☆234Updated last year
- EDRSandblast-GodFault☆240Updated last year
- Freeze.rs is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls written in RUST☆168Updated last month
- An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution☆136Updated 2 weeks ago
- .net config loader☆307Updated last year
- Patch AMSI and ETW☆231Updated 6 months ago
- A small program written in C that is designed to load 32/64-bit shellcode and allow for execution or debugging. Can also output PE files …☆124Updated 3 months ago
- ShellWasp is a tool to help build shellcode that utilizes Windows syscalls, while overcoming the portability problem associated with Wind…☆159Updated last year
- ☆181Updated last year
- Proof of Concept for manipulating the Kernel Callback Table in the Process Environment Block (PEB) to perform process injection and hijac…☆151Updated last week
- A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!☆317Updated 3 months ago
- Various resources to enhance Cobalt Strike's functionality and its ability to evade antivirus/EDR detection☆248Updated 5 months ago
- Open Source C&C Specification☆220Updated 3 weeks ago
- Vulnerable driver research tool, result and exploit PoCs☆180Updated last year
- A set of programs for analyzing common vulnerabilities in COM☆152Updated 2 months ago
- Exploitation of process killer drivers☆187Updated last year
- MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.☆193Updated last year
- Weaponized HellsGate/SigFlip☆192Updated last year