Defensive Tools

mrash/fwknop

Single Packet Authorization > Port Knocking

klezvirus/syswhispers3

SysWhispers on Steroids - AV/EDR evasion via direct system calls.

inverse-inc/packetfence

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a…

center-for-threat-informed-defense/adversary_emulation_library

An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.

awnumar/memguard

Software sandbox for storage of sensitive information in memory.

neo23x0/auditd

Best Practice Auditd Configuration

tkmru/awesome-edr-bypass

Curated collection of EDR bypass resources including PoCs, tools, workshops, presentations, and blogs for ethical hacking and red team operations.

jkornev/hidden

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

rgrove/sanitize

Ruby HTML and CSS sanitizer.

firehol/firehol

iptables-based stateful firewall with human-friendly configuration and optional QoS (FireQOS) for bandwidth management.

med0x2e/sigflip

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

uber-common/metta

An information security preparedness tool to do adversarial simulation.

jxy-s/herpaderping

Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of…

trailofbits/claude-code-devcontainer

Sandboxed devcontainer for running Claude Code in bypass mode safely. Built for security audits and untrusted code review.

owerdogan/whoami-project

Whoami provides enhanced privacy, anonymity for Debian and Arch based linux distributions

xacone/bestedrofthemarket

Open-source Windows kernel-level EDR lab for understanding and testing detection methods against process injection, credential dumping, and other…

omerya/invisi-shell

Hide your Powershell script in plain sight. Bypass all Powershell security features