
win-def-clickfix
A scanner that estimates whether Microsoft Defender is likely to flag a command as ClickFix.

A scanner that estimates whether Microsoft Defender is likely to flag a command as ClickFix.

Microsoft HEIF Extension (msheif_store.dll) OOB-read

MAPS cloud scanner and response parser for Microsoft Defender research.

Tool that allows comparing symbol, type and syscall information of Microsoft Windows binaries across different versions of the OS, using a Web UI…

Abuses the Microsoft-signed tlscsp.dll LOLBin to run RC4 encrypt/decrypt via LsCsp_EncryptHwid, patching the hardcoded key in memory for BYOK…

"In-depth reverse engineering analysis of Vidar Stealer 2.0 covering Task Scheduler tampering (1999 timestamps), Explorer.exe process hollowing, and…

Incident Response & Digital Forensics Debugging Extension
