s3n4t0r-0x0/apts-adversary-simulationRealistic APT adversary simulation campaigns with custom C2 frameworks, backdoors, stagers, and bootloaders mirroring state-sponsored TTPs for red…
joertx07/printnightmare-detection-labSplunk SIEM lab simulating and detecting CVE-2021-34527 (PrintNightmare) exploitation using Sysmon, Windows Event logs, and custom SPL detection…
arosenmund/defcon33_silence_kill_edrHands-on DEFCON workshop materials for killing and silencing EDR agents: lab setup, BYOVD, custom C/C++ evasion tooling, and reverse engineering.
deepinstinct/dirty-vanityWindows code injection PoC that abuses the fork API to execute ntdll-based shellcode in a forked process and bypass EDRs.
thewover/dinvokeDynamically invoke arbitrary unmanaged code from managed code without PInvoke.
print3m/dllshimmerWeaponize DLL hijacking easily. Backdoor any function in any DLL.
d419h/iconjectorInject DLLs into the explorer process using icons
amberwolfcyber/nachovpnA delicious, but malicious SSL-VPN server 🌮
d00mfist/mystikalGenerates macOS initial access payloads for Mythic C2: installer packages, Office macros, armed PDFs, disk images, and weaponized PIP/Ruby/NPM…
h1d3r/gpu_shellcodeHides reflective payloads in GPU memory via CUDA APIs, wiping host memory during sleep and using a VEH handler to restore executable memory, evading…
saadahla/heapcryptEncypting the Heap while sleeping by hooking and modifying Sleep with our own sleep that encrypts the heap
namazso/linux_injectorA simple ptrace-less shared library injector for x64 Linux
saadahla/pe-obfuscatorObfuscates PE binaries into fileless loaders that add PE sections, unhook ntdll, and exploit signed drivers to remove kernel callbacks for EDR…
adepts-of-0xcc/vba-macro-experimentsCollection of VBA macro published in our twitter / blog
idov31/jormungandrWindows kernel-mode COFF loader for executing x64 kernel COFF payloads, supports NTOSKRNL/SSDT imports and client-driven loading for red-team…
med0x2e/vba2clrExecutes .NET assemblies from Office VBA via AppDomain.ExecuteAssembly, automating COM objects and bypassing AccessVBOM for local or remote assembly…
thiagopeixoto/winsos-pocA PoC demonstrating code execution via DLL Side-Loading in WinSxS binaries.
techryptic/pokemon-shellcode-loaderTired of looking at hex all day and popping '\x41's? Rather look at Lugia/Charmander? I have the solution for you.
