
OnTheEdge
Windows research PoC in C that scans Microsoft Edge process memory for credential-related data, with a standalone executable and a BOF variant for C2…

Windows research PoC in C that scans Microsoft Edge process memory for credential-related data, with a standalone executable and a BOF variant for C2…

CVE-2017-0144

Incident Response & Digital Forensics Debugging Extension

A Linux version of the ProcDump Sysinternals tool

GC2 is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet or Microsoft SharePoint…

Honeypot for CVE-2025-53770 aka ToolShell

"In-depth reverse engineering analysis of Vidar Stealer 2.0 covering Task Scheduler tampering (1999 timestamps), Explorer.exe process hollowing, and…

Fully undetectable and evasive ransomware written in Rust, leveraging a BYOVD technique to disable AV/EDR solutions on the infected systems.

MAPS cloud scanner and response parser for Microsoft Defender research.

Evade behavioral analysis by executing malicious code within trusted Microsoft call stacks, patchless hooking library IAT/EAT.

Full exploit chain lab and Suricata IDS detection for CVE-2022-30190 (Follina) - MSDT RCE

Detects CanaryTokens in Office docs and PDFs (docx, xlsx, pptx, pdf) without triggering alerts

Complete analysis of CVE-2025-21298, a double free vulnerability related to ole32 library in windows.

A scanner that estimates whether Microsoft Defender is likely to flag a command as ClickFix.