zero2504 / Fairy-LawLinks
Fairy Law - Compromise or disable EDR security solutions
☆61Updated last month
Alternatives and similar repositories for Fairy-Law
Users that are interested in Fairy-Law are comparing it to the libraries listed below
Sorting:
- Modern PIC implant for Windows (64 & 32 bit)☆104Updated 5 months ago
- Blog/Journal on how to backdoor VSCode extensions☆76Updated 5 months ago
- Toolset to manipulate RPC clients by finding delayed services and masquerading as them☆106Updated 4 months ago
- Using Chromium-based browsers as a proxy for C2 traffic.☆134Updated last month
- Beacon Object File (BOF) for Using the BadSuccessor Technique for Account Takeover☆85Updated 2 months ago
- RPC to WebClient startup☆53Updated 4 months ago
- ☆54Updated 7 months ago
- Impersonate Tokens using only NTAPI functions☆83Updated 9 months ago
- A small collection of Crystal Palace PIC loaders designed for use with Cobalt Strike☆180Updated 2 months ago
- Beacon Object File (BOF) to obtain Entra tokens via authcode flow.☆105Updated 8 months ago
- A simple C++ Windows tool to get information about processes exposing named pipes.☆39Updated 10 months ago
- Cobalt Strike UDC2 implementation that provides an Slack C2 channel☆52Updated this week
- A BOF that suspends non-GUI threads for a target process or resumes them resulting in stealthy process silencing.☆57Updated 8 months ago
- PoC for generating bthprops.cpl module designed to be loaded by Fsquirt.exe LOLBin☆86Updated this week
- template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader.☆97Updated last month
- Attempting to Hook LSASS APIs to Retrieve Plaintext Credentials☆54Updated 7 months ago
- Tool to bypass LSA Protection (aka Protected Process Light)☆63Updated last year
- lsassdump via RtlCreateProcessReflection and NanoDump☆85Updated last year
- Remote BOF Runner is a Havoc extension framework for remote execution of Beacon Object Files (BOFs) using a PIC loader made with Crystal …☆81Updated last week
- ☆100Updated last year
- Indirect Syscall implementation to bypass userland NTAPIs hooking.☆83Updated last year
- Lateral movement with DCOM DLL hijacking☆174Updated 6 months ago
- ☆35Updated last year
- A BOF to enumerate system process, their protection levels, and more.☆123Updated last year
- Using call gadgets to break the call stack signature used by Elastic on proxying a module load. Provided as a Crystal Palace shared libra…☆73Updated 2 months ago
- ☆121Updated 11 months ago
- ☆83Updated last year
- Local SYSTEM auth trigger for relaying - X☆155Updated 5 months ago
- A PICO for Crystal Palace that implements CLR hosting to execute a .NET assembly in memory.☆124Updated last month
- a BOF implementation of various registry persistence methods☆92Updated last month