msf-ntdll Goto Github PK

sysmonsimulator

Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and correlation rules by Blue teams.

systemnightmare

Gives you instant SYSTEM command prompt on all supported and legacy versions of Windows

syswhispers2

AV/EDR evasion via direct system calls.

syswhispers2_x86

X86 version of syswhispers2 / x86 direct system call

syswhispers3

SysWhispers on Steroids - AV/EDR evasion via direct system calls.

takemyrdp

A keystroke logger targeting the Remote Desktop Protocol (RDP) related processes, It utilizes a low-level keyboard input hook, allowing it to record keystrokes in certain contexts (like in mstsc.exe and CredentialUIBroker.exe)

tamperingsyscalls

tangledwinexec

C# PoCs for investigation of Windows process execution techniques investigation

taowu-cobalt-strike

targetedkerberoast

Kerberoast with ACL abuse capabilities

tartarusgate

TartarusGate, Bypassing EDRs

taskschedulermisc

Misc TaskScheduler Plays

teamfiltration

TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts

teams_dump

PoC for dumping and decrypting cookies in the latest version of Microsoft Teams

technet-gallery

Copies of my 'Script Center' and 'Technet Gallery' publications

telemetry

ABUSING WINDOWS TELEMETRY FOR PERSISTENCE

terminator

Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes

terraldr

A Payload Loader Designed With Advanced Evasion Features

test

just test

tgsthief

My implementation of the GIUDA project in C++

tgtdelegation

tgtdelegation is a Beacon Object File (BOF) to obtain a usable TGT via the "TGT delegation trick"

thematrix

a PE Loader and Windows API tracer. Useful in malware analysis.

threadlessinject

Threadless Process Injection using remote function hooking.

threadlessinject-bof

BOF implementation of @_EthicalChaos_'s ThreadlessInject project. A novel process injection technique with no thread creation, released at BSides Cymru 2023.

threadstackspoofer

Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners and analysts.

timeexception

A tool to find folders excluded from AV real-time scanning using a time oracle

tiny-aes-c

Small portable AES128/192/256 in C

tinyprocessor

A post-processing script for TinyTracer

titan

Titan is a VMProtect devirtualizer

toggle_token_privileges_bof

Syscall BOF to arbitrarily add/detract process token privilege rights.