Ian G

Sanctum. Sanctum is an experimental proof-of-concept EDR, designed to detect modern malware techniques, above and beyond the capabilities of antivirus. Built in Rust.

Wyrm. The dragon in the dark. A red team post exploitation framework for testing security controls during red team assessments.

Hells-Hollow. Hells Hollow Windows 11 Rootkit technique to Hook the SSDT via Alt Syscalls

Rust-Hells-Gate. Rust malware EDR evasion via direct syscalls, fully implemented as an example in Rust

bloggr. A markdown compatible Golang blogging platform I use for my own blog

ETW-Bypass-Rust. Event Tracing for Windows EDR bypass in Rust (usermode)

BioNTdrv. Rust

Vectored-Exception-Handling-Squared. Vectored Exception Handling Squared

Scil. System Call Integrity Layer - experimental security research

rust_shellcode. Pipeline for creating shellcode from a nostd rust project.

Ferric-Fox. A windows 11 rootkit in Rust

wdk-mutex. An idiomatic Rust mutex type for Windows kernel driver development.

Rust-VBS-Enclave. Rust

GoSneak. DLL injector POC written currently in C++ to be wrapped with Go and CGO.

str_crypter. Str Crypter is a Rust macro to encrypt plaintext strings at compile time, and automatically decrypts them at runtime

Rust-APC-Queue-Injection. APC Queue Injection EDR Evasion in Rust

Basic-C-Reflective-DLL-Injector. A C based reflective DLL injector which will inject a DLL packed into the very same executable.

ZestyChips. Re-engineering of a .net stealer using IMAP for c2

Kernel-Fishing. A small Rust library with C interop for locating unexported/internal routines by byte pattern when no stable export exists.

Rust-DLL-Search-Order-Hijacking. Rust DLL Search Order Hijacking

velox. Velox is a work in progress, experimental Rust based Operating System written for fun and learning

PE-Export-Resolver. Library to resolve function pointers to loaded modules in memory, such as functions provided by Windows DLL's

maldev. ⚠️ malware development

Rust-Remote-Process-DLL-Injection. Remote process DLL Injection in Rust

CRTO-Notes. Certified Red Team Operator (CRTO) Cheatsheet and Checklist

chx. Clipboard HexDumper is a command-line tool that allows you to read binary data of a file on disk, convert it to a hex dump or a base64 encoded string, and copy it to the clipboard.

Simple-Rust-DLL. Rust

Rust-Simple-DLL-Injector. Introduction to the Windows API for Rust, demonstrating a simple DLL injector

SIMAP. A go based IMAP c2 server

windows-drivers-rs. Platform that enables Windows driver development in Rust. Developed by Surface.

ART-A-Radio-Telescope. Meet Art, he is A (simple) Radio Telescope. Art will be able to look into the galaxy and observe large hydrogen clouds undergoing quantum effects emitting radiation at a wavelength of approximatley 21 cm. Art will also measure the relative velocity of various parts of the Milky Way compared to the velocity of the Earth.

wdk_mutex_tests. Rust