
ProcDump-for-Linux
A Linux version of the ProcDump Sysinternals tool

A Linux version of the ProcDump Sysinternals tool

A scanner that estimates whether Microsoft Defender is likely to flag a command as ClickFix.

Windows research PoC in C that scans Microsoft Edge process memory for credential-related data, with a standalone executable and a BOF variant for C2…

Detects CanaryTokens in Office docs and PDFs (docx, xlsx, pptx, pdf) without triggering alerts

"In-depth reverse engineering analysis of Vidar Stealer 2.0 covering Task Scheduler tampering (1999 timestamps), Explorer.exe process hollowing, and…

GC2 is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet or Microsoft SharePoint…

Full exploit chain lab and Suricata IDS detection for CVE-2022-30190 (Follina) - MSDT RCE

Fully undetectable and evasive ransomware written in Rust, leveraging a BYOVD technique to disable AV/EDR solutions on the infected systems.

MAPS cloud scanner and response parser for Microsoft Defender research.

Evade behavioral analysis by executing malicious code within trusted Microsoft call stacks, patchless hooking library IAT/EAT.

CVE-2017-0144

Complete analysis of CVE-2025-21298, a double free vulnerability related to ole32 library in windows.

Honeypot for CVE-2025-53770 aka ToolShell

Incident Response & Digital Forensics Debugging Extension