

Kratos is a high-performance Windows File System Minifilter driver designed to detect, block, and permanently immunize

Obfuscate specific windows apis with different apis

Windows honeypot using ProjFS to project decoy files that trigger Event Log and desktop alerts when accessed, with SMB remote session logging for…

ETW-based Windows process creation logger that enriches events with file hashes, signatures, and parent process details, outputting to Windows…

BlockGuard is a Windows Data Loss Prevention (DLP) agent that intercepts and controls file access at the process level. It ensures that only…

PowerShell tool for red teamers that clears execution evidence by stopping event logging, removing file and registry artifacts, and saving timestamps…

A next-generation multi-echelon anti-ransomware fortress for Windows, combining hypervisor, eBPF, AI deception, and hardware-enforced security.


OS-level monitor for AI agents: observes processes, file access, and network activity on the local machine and attributes each event to an agent…

7-Zip CVE-2022-29072 Mitigation - CHM file - This script detects if the .chm file exists and removes it.

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

LoadLibrary for offensive operations

A unique technique to execute binaries from a password protected zip

AppLocker-Based EDR Neutralization