zblurx / impersonate-rs

Related projects: ⓘ

• rasta-mouse / PPEnum
  Simple BOF to read the protection level of a process
  ☆101Updated last year
• BC-SECURITY / ScriptBlock-Smuggling
  Example code samples from our ScriptBlock Smuggling Blog post
  ☆80Updated 3 months ago
• MayerDaniel / profiler-lateral-movement
  Lateral Movement via the .NET Profiler
  ☆74Updated 3 months ago
• zimnyaa / noWatch
  Implant drop-in for EDR testing
  ☆126Updated 10 months ago
• naksyn / ProcessStomping
  A variation of ProcessOverwriting to execute shellcode on an executable's section
  ☆147Updated 9 months ago
• waawaa / AMSI_Rubeus_bypass
  ☆61Updated 2 years ago
• reveng007 / AMSI-patches-learned-till-now
  I have documented all of the AMSI patches that I learned till now
  ☆66Updated last year
• synacktiv / OUned
  The OUned project automating Active Directory Organizational Units ACL exploitation through gPLink poisoning
  ☆71Updated 5 months ago
• ChoiSG / OneDriveUpdaterSideloading
  Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post
  ☆84Updated last year
• morRubin / NegoExRelay
  ☆83Updated 2 years ago
• securityandstuff / DynamicFinder
  ☆65Updated this week
• xpn / CloudInject
  ☆101Updated 4 months ago
• xforcered / BOFMask
  ☆116Updated last year
• Crypt0s / DelegationBOF
  ☆135Updated 2 years ago
• oldboy21 / JayFinder
  Find DLLs with RWX section
  ☆74Updated last year
• rasta-mouse / SpawnWith
  ☆90Updated 6 months ago
• S4ntiagoP / donut
  Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…
  ☆109Updated 10 months ago
• Wh04m1001 / DiagTrackEoP
  ☆87Updated 2 years ago
• xalicex / LOLDrivers_finder
  ☆70Updated last year
• naksyn / Embedder
  Embedder is a collection of sources in different languages to embed Python interpreter with minimal dependencies
  ☆110Updated 3 months ago
• eversinc33 / Godmode
  Tool for playing with Windows Access Token manipulation.
  ☆50Updated last year
• Kudaes / Bin-Finder
  Detect EDR's exceptions by inspecting processes' loaded modules
  ☆120Updated 6 months ago
• mgeeky / msi-shenanigans
  Proof of Concept code and samples presenting emerging threat of MSI installer files.
  ☆77Updated last year
• iamagarre / BadExclusionsNWBO
  BadExclusionsNWBO is an evolution from BadExclusions to identify folder custom or undocumented exclusions on AV/EDR
  ☆69Updated 7 months ago
• securityandstuff / DllLoadPath
  ☆140Updated this week
• mlcsec / ASRenum-BOF
  Cobalt Strike BOF that identifies Attack Surface Reduction (ASR) rules, actions, and exclusion locations
  ☆136Updated 6 months ago
• joe-desimone / rep-research
  ☆62Updated last month
• MaorSabag / SideLoadingDLL
  Do some DLL SideLoading magic
  ☆72Updated 11 months ago
• OmriBaso / WTSImpersonator
  WTSImpersonator utilizes WTSQueryUserToken to steal user tokens by abusing the RPC Named Pipe "\\pipe\LSM_API_service"
  ☆114Updated 2 months ago
• mansk1es / GhostFart
  ☆132Updated last year