Tools

microsoft/pyrit

Open-source framework for red-teaming generative AI systems: automate attack prompts, score model responses, and audit behavior to identify security…

misp/misp-galaxy

Clusters and elements to attach to MISP events or attributes (like threat actors)

trailofbits/anamorpher

image scaling attacks for multi-modal prompt injection

0xb11a1/yetanotherobfuscator

C# obfuscator that bypass windows defender

senzee1984/edrprison

Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry

redcanaryco/chain-reactor

Generate Linux executables that simulate adversary behaviors and techniques for testing detection and response coverage. Consumes JSON for easy…

daem0nc0re/atomicsyscall

Tools and PoCs for Windows syscall investigation.

deepinstinct/nofilter

Abuses Windows Filtering Platform to launch a console as NT AUTHORITY\SYSTEM or impersonate another logged-on user for privilege escalation during…

telefonica/attpwn

ATTPwn

cyberforce/pesidious

Malware Mutation Using Reinforcement Learning and Generative Adversarial Networks

kudaes/bin-finder

Detect EDR's exceptions by inspecting processes' loaded modules

cybrly/badsuccessor

Exploits the Windows Server 2025 dMSA privilege escalation vulnerability to enumerate writable OUs, escalate to arbitrary domain users, extract…

frank2/blenny

A payload delivery system which embeds payloads in an executable's icon file!

lleon1435/kernel_vadinjector

Windows 10 DLL Injector via Driver utilizing VAD and hiding the loaded driver

alwashali/detection-validation

Detection rule validation

xiaoyan-lisa/defenses-for-tool-integrated-llm

Research code and experiments for defending tool-integrated LLM agents against adversarial attacks, extending Agent Security Bench with new defense…

usama1002/deleting-the-trace

Experiments for control-token chain-of-thought suppression and parser-leniency attacks on tool-using LLM agents