Josh

ModuleStomped. Proof of concept to detect module stomping detection by looking for modified .pdata sections.

cet-spoofing-detection. Stack spoofing Detection for CET processes by comparing shadow and user stacks.

vehspoof. Callstack spoofing using a VEH because VEH all the things.

static-nmap. Statically compiled nmap with scripting

taskpwn. Remote Task Scheduler Enumeration

jbstrike. A Small, Simple C2. Designed to be lightweight.

httpdropper. Simple HTTP Shellcode dropper, designed only to defeat defender

EyYoEtwWhereYouAt. Correlating kernel notifications with the lack of ETW events to detect ETW Patching

Amsi-Patch. AMSI ScanBuffer Patch with API Hook poc

SuspiciousThreads. A Poc attempt at hunting suspicious thread creation events using ETW only.

0xjbb.

NetExec. The Network Execution Tool

http. Simple HTTP File server with upload support for pen-testing CTFs

indirect-syscalls. Indirect Syscall implementation, nothing new.

wde-bypass. Windows Defender Anti Virus Emulator Bypasses