MrKaplan
idov31/mrkaplanPowerShell tool for red teamers that clears execution evidence by stopping event logging, removing file and registry artifacts, and saving timestamps…
defensive-toolsforensicsids-ips-evasion+3
276
idov31/mrkaplanPowerShell tool for red teamers that clears execution evidence by stopping event logging, removing file and registry artifacts, and saving timestamps…
anthemtotheego/sharpsploitconsoleC# console application for post-exploitation and red team operations, integrating SharpSploit to execute Mimikatz commands, perform Kerberoasting,…
darmado/atomic-red-team-c2ARTi-C2 is a post-exploitation framework used to execute Atomic Red Team test cases with rapid payload deployment and execution capabilities via…
twosevenonet/edr-redirRedirects EDR working folders using a Bind Filter (bindflt.sys) to bypass endpoint detection, corrupt EDR services, or replace with…
dylandavis1/dscourierProof-of-concept tool leveraging WinGet Configuration COM API to apply DSC configurations through Microsoft-signed binaries, enabling EDR bypass for…
mr-un1k0d3r/redteamscriptsCollection of offensive red team scripts including process termination, SPF bypass for phishing, password spraying, and ColdFusion password…
cyborgsecurity/poisonappleCLI tool for applying and removing macOS persistence mechanisms, designed for threat emulation and red team operations. Supports 17 techniques…
redteamguides/redteamguides.github.ioRed Team Guides
octoberfest7/cohab_processesA small Aggressor script to help Red Teams identify foreign processes on a host machine
kozmer/aad-bofsCobalt Strike BOF collection for attacking Azure AD during red team operations, covering authentication, enumeration, and post-exploitation vectors.
hyd3sec/azur3alph4PowerShell module for post-breach Azure red teaming, automating token extraction, resource enumeration, and lateral movement within managed identity…
xret2pwn/picklec2Encrypted C2 framework for post-exploitation and lateral movement, supporting PowerShell implants and custom modules for red team engagements.
trevohack/dynastypersistLinux persistence toolkit with 11 modules for SSH key backdoors, cronjobs, systemd services, LKM rootkits, and LD_PRELOAD privilege escalation.…
voukatas/commanderPython-based command and control framework with encrypted TLS communication, multiple agent support (Python/C), interactive sessions, file transfer,…
grines/scourModule-based AWS exploitation framework for red team testing and blue team analysis. Emulates attack patterns in the AWS control plane with unique UA…
lloydlabs/process-enumeration-stealthStealth Windows process enumeration PoC that lists PIDs using NTFS via NtQueryInformationFile, bypassing standard monitoring APIs and enabling EDR…
blacksnufkin/pt-toolkitExploits Scripts and other tools that are useful during Penetration-Testing or Red Team engagement
yehia-mamdouh/shell3erPowerShell-based reverse shell with background task execution, file transfer, and dual persistence mechanisms via registry and startup folder for red…