Tools

josh-blythe/bordair-detector

Two-stage prompt-injection and jailbreak detector: regex gates plus a quantised DeBERTa-v3 ONNX classifier, with image, document, and audio support.…

netero1010/edrsilencer

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

med0x2e/gadgettojscript

A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA…

thewover/dinvoke

Dynamically invoke arbitrary unmanaged code from managed code without PInvoke.

senzee1984/edrprison

Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry

bishopfox/deephack

PoC code from DEF CON 25 presentation

rsmudge/unhook-bof

Remove API hooks from a Beacon process.

saadahla/ntdllreflection

Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle to ntdll ,…

mitre/brawl-public-game-001

Data from a BRAWL Automated Adversary Emulation Exercise

bananabr/timeexception

A tool to find folders excluded from AV real-time scanning using a time oracle

med0x2e/vba2clr

Running .NET from VBA

nul0x4c/etwsessionhijacking

A Poc on blocking Procmon from monitoring network events

toxy4ny/delirium-ai-safety-benchmark

A diagnostic framework for measuring LLM vulnerability to Affective Contextual Erosion (ACE) and related liminal attack vectors. **Delirium** is not…

guillaumemeyer/watermarks-remover

Strip multi-vendor AI provenance marks: Unicode text hygiene, statistical rewrite hooks, and C2PA/metadata from PNG/JPEG/SVG/PDF/DOCX/HTML/MD

matheuzsecurity/ringreaper

Linux post-exploitation agent that uses io_uring to stealthily bypass EDR detection by avoiding traditional syscalls.

asset-group/ghostsplice

Ghostsplice repository: PoC for Cross-Channel Trust Fragmentation Attack