
EDRSilencer
A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

This repo contains C/C++ snippets that can be handy in specific offensive scenarios.

Performing Indirect Clean Syscalls

Red Team K8S Adversary Emulation Based on kubectl

C++ self-Injecting dropper based on various EDR evasion techniques.

HyperDeceit is the ultimate all-in-one library that emulates Hyper-V for Windows, giving you the ability to intercept and manipulate operating system…

Call stack spoofing for Rust

A delicious, but malicious SSL-VPN server 🌮

PoC demonstrating a multi process injection chain aimed at remotely executing shellcode

Malware Mutation Using Reinforcement Learning and Generative Adversarial Networks

Project Mantis: Hacking Back the AI-Hacker; Prompt Injection as a Defense Against LLM-driven Cyberattacks

Windows 10 DLL Injector via Driver utilizing VAD and hiding the loaded driver

Hardware Breakpoint (DR0-DR7) based patch-less user-mode hooking & telemetry instrumentation engine (AMSI, WLDP & ETW PoC).

Detection rule validation

Crystal Palace library for proxying Nt API calls via the Threadpool. Updated for call gadgets.

CVE-2026-54121 (Certighost) AD CS DC-impersonation PoC. Patched SAN handling + MAQ-safe account reuse.

Practical black-box adversarial packet generation against encrypted traffic classification with minimal overhead and full packet recoverability.