wietze / windows-command-line-obfuscation
Project for identifying executables that have command-line options that can be obfuscated, possibly bypassing detection rules.
☆141Updated this week
Alternatives and similar repositories for windows-command-line-obfuscation:
Users that are interested in windows-command-line-obfuscation are comparing it to the libraries listed below
- Load any Beacon Object File using Powershell!☆245Updated 3 years ago
- A repository that maps commonly used attacks using MSRPC protocols to ATT&CK☆317Updated last year
- Cobalt Strike Beacon configuration extractor and parser.☆149Updated 3 years ago
- Koppeling x Metatwin x LazySign☆205Updated 3 years ago
- LiquidSnake is a tool that allows operators to perform fileless lateral movement using WMI Event Subscriptions and GadgetToJScript☆327Updated 3 years ago
- A Cobalt Strike Scanner that retrieves detected Team Server beacons into a JSON object☆164Updated 2 years ago
- Apply a filter to the events being reported by windows event logging☆260Updated 3 years ago
- AzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Co…☆213Updated 3 years ago
- An effort to track security vendors' use of Microsoft's Antimalware Scan Interface☆236Updated 2 years ago
- ☆257Updated last year
- Identify the attack paths in BloodHound breaking your AD tiering☆313Updated 2 years ago
- ☆125Updated 3 years ago
- ☆184Updated 2 years ago
- StandIn is a small .NET35/45 AD post-exploitation toolkit☆253Updated 3 years ago
- ☆144Updated last year
- SpecterOps Presentations☆184Updated 2 months ago
- ☆162Updated 2 years ago
- Modular C# framework to exfiltrate loot over secure and trusted channels.☆122Updated 3 years ago
- ☆204Updated 2 years ago
- ☆243Updated last year
- Simple EDR implementation to demonstrate bypass☆163Updated 4 years ago
- 64bit Windows 10 shellcode that injects all processes with Meterpreter reverse shells.☆127Updated last year
- Start new PowerShell without etw and amsi in pure nim☆157Updated 2 years ago
- Python library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles☆154Updated 3 months ago
- Scripts for performing and detecting parent PID spoofing☆141Updated 4 years ago
- Run Rubeus via Rundll32☆199Updated 4 years ago
- Find interesting files stored on (System Center) Configuration Manager (SCCM/CM) SMB shares☆166Updated last year
- Proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that b…☆233Updated 3 years ago
- ☆95Updated 3 months ago