Nedim Šabić²

compress. Optimized Go Compression Packages

win32k-callback-detouring. Abusing the win32k.sys kernel callback mechanism for arbitrary code execution

Kassandra. Reversed cassandra source code for educational purposes

gluegate. Memory API proxy via signed mozglue.dll

SukiUI. UI Theme for AvaloniaUI

shad-ui. Avalonia-based UI Library inspired by shadcn and Suki UI Library

Avalonia. Develop Desktop, Embedded, Mobile and WebAssembly apps with C# and XAML. The future of .NET UI

LACUNA-Chain. Six-layer call-stack spoofing via .pdata lacunae — defeats ETW-Ti, kernel callbacks, CET shadow stack, and return-address validation in a single composite chain.

RawHive. Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file data straight from disk.

entropia. A compiled language for Windows position-independent x86-64 shellcode and Beacon Object Files.

AV-EDR-Killer. BYOVD PoC abusing the GoFly kernel driver to terminate protected processes from user mode via an unguarded IOCTL.Then Weaponize it to execute shell code

PhantomCtx. Activation Context Hijacking Evasion Tool

kassandra_x33fcon_2026. This repository contains the research tool presented at x33fcon 2026, along with the associated presentation slides. The content is made available for research and educational purposes.

duckdb. DuckDB is an analytical in-process SQL database management system

duckdb-go. duckdb-go provides a database/sql driver for the DuckDB database engine.

LdrShuffle. Code execution/injection technique using DLL PEB module structure manipulation

Shelter. ROP-based sleep obfuscation to evade memory scanners

RustChain. Hide memory artifacts using ROP and hardware breakpoints.

apiwatcher. Standalone Windows API call tracer

rsigma. A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:

cet-spoofing-detection. Stack spoofing Detection for CET processes by comparing shadow and user stacks.

DSCourier. DSCourier is a proof-of-concept that uses the WinGet Configuration COM API to apply DSC configurations through Microsoft-signed binaries.

CustomRDI. Rewrite of Stephen Fewer's reflective DLL loader with djb2 hashing, indirect syscalls, forwarder handling, and per-section memory permissions

Fileless-Pe-Loader. A stealthy in-memory PE loader that downloads and executes Windows executables directly from RAM with ETW bypass, NTDLL unhooking. No disk writes, no traces.

Vectored-Overloading. Using Vectored Exception Handling and hardware breakpoint to hijack DLL loading

ruac. UAC bypass I wrote for Interium. Uses the CMSTP INF.

StackSentry. Windows memory scanner for call stack spoofing detection, unbacked shellcode, injected DLLs and in-memory C2 implants.

HellHall. Performing Indirect Clean Syscalls

GhostlyHollowingViaTamperedSyscalls2. Implementing Ghostly-Hollowing using tampered syscalls for remote PE injection

Tenebris-Gate. multi layer encryption for payloads with options of delivery welcome to the Tenebris side

Tenzo-X-DSI. Direct syscall DLL injector. Bypasses API hooks via Halo's Gate SSN recovery, RWX allocation, and manual PE mapping. Includes ETW patching, PEB debug flag clearing, and header wiping. Console UI with CLI support.

Monologue-Pwn. Steal Net-NTLMv1 hashes for logged on users without dumping LSASS

goodboy-framework. Learn Windows malware development and defense in Rust with 15 stages covering offense, detection, and AV testing

btype. B-tree based collection types for Go

SharpWMI. SharpWMI is a C# implementation of various WMI functionality.

SharpRDP. Remote Desktop Protocol .NET Console Application for Authenticated Command Execution

NEBULA. Interactive PowerShell framework for testing WMI, COM, LOLBAS, and persistence techniques

AwesomeMalDevLinks. Awesome MalDev Links

DeadMatter. Offset Independent Credential Extraction Tool

DoppelGate. DoppelGate relies on reading ntdll on disk to grab syscall stubs, and patches these syscall stubs into desired functions to bypass Userland Hooking.

Probatorum-EDR-Userland-Hook-Checker. Project to check which Nt/Zw functions your local EDR is hooking

RightHand-Persistence. COM Windows Persistence Technique

vss-fr2system. test

RustPatchlessCLRLoader. .NET assembly loader with patchless AMSI and ETW bypass in Rust

HellsVectoredGate. C

PhantomRPC. C

superpowers. An agentic skills framework & software development methodology that works.

PRTextractor. Go

trustme. BOF to impersonate TrustedInstaller via DISM API trigger and thread impersonation

AFInjector. Hides in your attic... I mean process

CustomLoadImage. Stealthy .NET assembly loading using AssemblyNative::LoadFromBuffer

owLSM. Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities

ECC. The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

KaplaStrike. A Cobalt Strike RL built with Crystal Palac; module overloading, NtContinue entry transfer, call stack spoofing, sleep masking, and static signature removal.

PyrsistenceSniper. We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.

ThreadCPUAssignment_POC. A small experiment on assigning a processes threads a specific CPU and then blocking it with a high priority thread

lnk-it-up. Project for generating and identifying deceptive LNK files.

SysWhispers4. AV/EDR evasion via direct and indirect system calls Windows NT 3.1 through Windows 11 24H2 · x64 · x86 · WoW64 · ARM64

azazel. eBPF-powered silent observer for containerized runtimes, built for malware analysis sandboxes and Agentic AI monitoring.

claude-code-best-practice. from vibe coding to agentic engineering - practice makes claude perfect

IoskeleyMono. Iosevka configuration to mimic the look and feel of Berkeley Mono as closely as possible.

marco. Inter-binary control flow graphing

lsa-whisperer. Tools for interacting with authentication packages using their individual message protocols

claude-code. Tips and tricks I use to optimize my experience with Claude Code.

AudioDG.exe-DLL-Hijacking-for-LPE. Audiodg.exe DLL hijacking for LPE with reboot-free restart primitive. Executes code as LOCAL SERVICE, escalates to SYSTEM via Scheduled Tasks.

Huginn. C++

chartdb. Database diagrams editor that allows you to visualize and design your DB with a single query.

rustinel. Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.

triager. Triage automation tool

awesome-maintainer-funding. A curated list of funding programs supporting the awesome work of Open Source maintainers.

design-patterns-for-humans. An ultra-simplified explanation to design patterns

warbird-demos. C++

dumping_lsass. The different ways to dump lsass

EventHorizon. Tool that gathers a customizable set of ETW telemetry and generates user-defined detections

DumpBrowserSecrets. Extracts browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from modern Chromium-based and Gecko-based browsers (Chrome, Microsoft Edge, Firefox, Opera, Opera GX, and Vivaldi)

BypassAV. This map lists the essential techniques to bypass anti-virus and EDR

FilelessPELoader. Loading Remote AES Encrypted PE in memory , Decrypted it and run it

ThreatIntelligenceConsumer. Demonstrates consuming from a SecurityTrace ETW session by consuming from the Threat-Intelligence ETW provider without a driver or PPL privilege

Probabilistic-Call-Stack-PoC. A proof-of-concept to demonstrate randomized execution paths and their impact on call stack signatures — ideal for EDR testing, behavior-based detection research, and evasion analysis.

CallStackSpoof. Example of call stack spoofing trough the construction of syntetic frames and stack manipulation

psc. the ps utility, with an eBPF twist and container context

PoC. Various PoCs

cerberus. Know what's happening on your network before it becomes a problem: real-time eBPF monitoring

defender-acl-blocker. Block Windows Defender by deny ACL

getSPNless. Python tool to automatically perform SPN-less RBCD attacks.

notes. Full of public notes and Utilities

Proxy-DLL-Loads. A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.

EDR-GhostLocker. AppLocker-Based EDR Neutralization

DbgNexum. Shellcode injection using the Windows Debugging API

open-backup-ui. Community dashboard for monitoring supported platforms via REST APIs.

linux-sysops-handbook. Essentials of Linux system administration.

SpoolSample. PoC tool to coerce Windows hosts authenticate to other machines via the MS-RPRN RPC interface. This is possible via other protocols as well.

DragonCastle. A PoC that combines AutodialDLL lateral movement technique and SSP to scrape NTLM hashes from LSASS process.

ntlm_theft. A tool for generating multiple types of NTLMv2 hash theft files by Jacob Wilkin (Greenwolf)

PetitPotam. PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.

SAMDump. Extract the SAM and SYSTEM hives using the Volume Shadow Copy (VSS) API. With exfiltration and XOR obfuscation options. Implemented in C#, C++, Crystal and Python

DumpChromeSecrets. Extract data from modern Chrome versions, including refresh tokens, cookies, saved credentials, autofill data, browsing history, and bookmarks

CPLDCOMTrigger. Python

invisible-unicode-obfuscation-poc. HTML

ms-photos_NTLM_Leak. New 0 day vulnerability allowing to leak NTLM hashes from browsers with one click