

7-Zip CVE-2022-29072 Mitigation - CHM file - This script detects if the .chm file exists and removes it.

AppLocker-Based EDR Neutralization

OS-level monitor for AI agents: observes processes, file access, and network activity on the local machine and attributes each event to an agent…

A next-generation multi-echelon anti-ransomware fortress for Windows, combining hypervisor, eBPF, AI deception, and hardware-enforced security.

Kratos is a high-performance Windows File System Minifilter driver designed to detect, block, and permanently immunize

BlockGuard is a Windows Data Loss Prevention (DLP) agent that intercepts and controls file access at the process level. It ensures that only…


LoadLibrary for offensive operations

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

ETW-based Windows process creation logger that enriches events with file hashes, signatures, and parent process details, outputting to Windows…

PowerShell tool for red teamers that clears execution evidence by stopping event logging, removing file and registry artifacts, and saving timestamps…

A unique technique to execute binaries from a password protected zip

Obfuscate specific windows apis with different apis

Windows honeypot using ProjFS to project decoy files that trigger Event Log and desktop alerts when accessed, with SMB remote session logging for…