msf-ntdll Goto Github PK

syswhispers3

SysWhispers on Steroids - AV/EDR evasion via direct system calls.

takemyrdp

A keystroke logger targeting the Remote Desktop Protocol (RDP) related processes, It utilizes a low-level keyboard input hook, allowing it to record keystrokes in certain contexts (like in mstsc.exe and CredentialUIBroker.exe)

tamperingsyscalls

tangledwinexec

C# PoCs for investigation of Windows process execution techniques investigation

taowu-cobalt-strike

targetedkerberoast

Kerberoast with ACL abuse capabilities

tartarusgate

TartarusGate, Bypassing EDRs

taskschedulermisc

Misc TaskScheduler Plays

teamfiltration

TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts

technet-gallery

Copies of my 'Script Center' and 'Technet Gallery' publications

terminator

Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes

terraldr

A Payload Loader Designed With Advanced Evasion Features

test

just test

tgsthief

My implementation of the GIUDA project in C++

tgtdelegation

tgtdelegation is a Beacon Object File (BOF) to obtain a usable TGT via the "TGT delegation trick"

thematrix

a PE Loader and Windows API tracer. Useful in malware analysis.

threadlessinject

Threadless Process Injection using remote function hooking.

threadlessinject-bof

BOF implementation of @_EthicalChaos_'s ThreadlessInject project. A novel process injection technique with no thread creation, released at BSides Cymru 2023.

threadstackspoofer

Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners and analysts.

timeexception

A tool to find folders excluded from AV real-time scanning using a time oracle

tiny-aes-c

Small portable AES128/192/256 in C

tinyprocessor

A post-processing script for TinyTracer

toggle_token_privileges_bof

Syscall BOF to arbitrarily add/detract process token privilege rights.

token-priv

Token Privilege Research

tokenattack

tokenizer

Kernel Mode Driver for Elevating Process Privileges

tokenplayer

Manipulating and Abusing Windows Access Tokens.

tokenprivilegeassigner

tokentacticsv2

A fork of the great TokenTactics with support for CAE and token endpoint v2

tokenuniverse

An advanced tool for working with access tokens and Windows security policy.