#1Tools for blue team, defensive security, and threat protection.
Kitploit recommended
keowu/badrentdrv2A vulnerable driver exploited by me (BYOVD) that is capable of terminating several EDRs and antivirus software in the market, rendering them…
gamingwithevets/msdt-disableMSDT protocol disabler (CVE-2022-30190 patch tool)
fusion1110/ebpf-hid_guardLinux kernel-space HID injection attack detector using eBPF. Monitors USB and Bluetooth HID devices for anomalous keystroke timing and automatically…
mozilla/bleachBleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes
kiexitdispatcher/godefenderAnti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package. Windows ONLY.
0x0v1/audixAudix is a PowerShell tool to quickly configure the Windows Event Audit Policies for security monitoring
mandiant/silketwC# wrapper for ETW that serializes kernel and user-mode event data to JSON for threat hunting, malware analysis, and incident response, with Yara…
gabriellandau/edrsandblast-godfaultEDRSandblast-GodFault
accenture/spartacusSpartacus DLL/COM Hijacking Toolkit
optiv/mangleMangle is a tool that manipulates aspects of compiled executables (.exe or DLL) to avoid detection from EDRs
swimlane/atomic-operatorA Python package is used to execute Atomic Red Team tests (Atomics) across multiple operating system environments.
idov31/functionstompingShellcode injection technique. Given as C++ header, standalone Rust program or library.
chryzsh/darthsidiousBuilding an Active Directory domain and hacking it
hlldz/reflexxionRefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first…
salesforce/metabadgerPrevent SSRF attacks on AWS EC2 via automated upgrades to the more secure Instance Metadata Service v2 (IMDSv2).
ranguli/ioccheckA tool for simplifying the process of researching IOCs.
