Detects Module Stomping as implemented by Cobalt Strike
☆17Dec 13, 2020Updated 5 years ago
Alternatives and similar repositories for DetectCobaltStomp
Users that are interested in DetectCobaltStomp are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- some research on EDR deconditioning☆16Jun 4, 2026Updated 4 months ago
- External C2 is a specification to allow third-party programs to act as a communication layer for Cobalt Strike’s Beacon payload.☆22Jul 17, 2025Updated last year
- ☆37May 19, 2026Updated 4 months ago
- A simple OAuth App designed to capture OAuth tokens when users authenticate through GitHub OAuth flow.☆28Apr 20, 2026Updated 5 months ago
- Show Window Stations, Desktops and top level windows☆18Jun 10, 2023Updated 3 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- A python polymorphic engine for C programs☆11Dec 8, 2023Updated 2 years ago
- Pass-the-Passkey Family of Attacks☆233Sep 14, 2026Updated last month
- Run unsigned kernel payloads in a signed kernel driver via wasm3. No JIT/W^x (HVCI/etc., compliant)☆151Aug 18, 2026Updated last month
- An Aggressor Script that utilizes NtCreateUserProcess to run binaries☆32Jan 30, 2025Updated last year
- OneDrive as a covert C2 transport for Cobalt Strike☆77Sep 19, 2026Updated 3 weeks ago
- A VSCode plugin to assist with BOF development.☆36Aug 14, 2024Updated 2 years ago
- Parser and reconciliation tooling for large Active Directory environments.☆33Feb 18, 2025Updated last year
- One PsExec client to rule them all☆15Mar 25, 2026Updated 6 months ago
- Dumping LSA secrets: a story about task decorrelation☆15Jul 9, 2024Updated 2 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Snaffler in Python☆121Oct 1, 2026Updated 2 weeks ago
- Uses InstallUtil.exe to load a compatible executable from a network share.☆12Mar 8, 2016Updated 10 years ago
- Process doppelganging POC using direct system calls, PPID spoofing and dropbox as an external delivery channel for the payload.☆17Jan 7, 2021Updated 5 years ago
- Porting of NPPSPY by Grzegorz Tworek to 'man in the middle' the user logon process, and store the user's name and password in an unassumi…☆20Apr 24, 2023Updated 3 years ago
- Ask the Web Account Manager (WAM) for Entra ID tokens☆162Sep 11, 2026Updated last month
- A collection of Terraform projects, Ansible playbooks, and roles designed to build a Red Team infrastructure.☆18Oct 9, 2026Updated last week
- ☆127Dec 11, 2025Updated 10 months ago
- A rust proof of concept to demonstrate registry overwriting via RegRestoreKey using the Offline Registry Library☆24Nov 13, 2025Updated 11 months ago
- Self Delete DLL☆22Feb 15, 2024Updated 2 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Demonstrating 3 persistence layers from a single EXE, that converts itself into proxy DLLs at runtime☆107Mar 29, 2026Updated 6 months ago
- A simple BOF that disables some logging with NtSetInformationProcess☆14Oct 13, 2023Updated 3 years ago
- ☆73Apr 20, 2026Updated 5 months ago
- Proof of concept - Covert Channel using Windows Filtering Platform (C#)☆21Aug 29, 2021Updated 5 years ago
- A windows 11 rootkit in Rust☆20Mar 23, 2025Updated last year
- Collection of shellcode injection and execution techniques☆17Mar 17, 2026Updated 7 months ago
- WasmForge — compile Go and C# programs to single-binary, WASM-sandboxed native executables with polymorphic output.☆133Jun 24, 2026Updated 3 months ago
- PXEThief is a set of tooling that can extract passwords from the Operating System Deployment functionality in Microsoft Endpoint Configur…☆27Feb 24, 2026Updated 7 months ago
- ELF Beacon Object File (BOF) Template☆20Nov 18, 2024Updated last year
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, S…☆140Aug 13, 2026Updated 2 months ago
- rust clr heap encryption (https://github.com/lap1nou/CLR_Heap_encryption), but no heap encryption.☆17Jan 6, 2024Updated 2 years ago
- Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctype…☆137Sep 27, 2023Updated 3 years ago
- A PoC of Stack encryption prior to custom sleeping by leveraging CPU cycles.☆68May 2, 2023Updated 3 years ago
- Deep insights into EDR detection approaches☆103Sep 27, 2026Updated 2 weeks ago
- Filesystem interaction via firebeam virtual machine execution☆59Mar 26, 2026Updated 6 months ago
- A vibe-coded port of wiretap☆37Apr 25, 2026Updated 5 months ago