InvokeThreatGuy

AggressorCollection. Collection of awesome Cobalt Strike Aggressor Scripts. All credit due to the authors

C2Kv2. Updated version of C2K

PreludeOperator_QuickCheck. Simple Powershell Prelude Operator Quick Check

universal-syscall-64. Resolve syscall numbers at runtime for all Windows versions.

LockdExeDemo. A demo of the relevant blog post: https://www.arashparsa.com/hook-heaps-and-live-free/

BSidesTO2017. Slides and demo content from our BSidesTO 2017 presentation.

AlternativeShellcodeExec. Alternative Shellcode Execution Via Callbacks

DC416October. Examples used in the October DC416 meetup

uefi-ntfs. UEFI:NTFS - Boot NTFS or exFAT partitions from UEFI

Smug_Fu3k. C++

mitmproxy2swagger. Automagically reverse-engineer REST APIs via capturing traffic

C2-Tool-Collection. A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.

Osiris-Sourcecode. Alleged source code leak of Osiris banking trojan

Penetration-Testing-Tools. A collection of more than 170+ tools, scripts, cheatsheets and other loots that I have developed over years for Red Teaming/Pentesting/IT Security audits purposes. Most of them came handy on at least one of my real-world engagements.

GoodHound. Uses Sharphound, Bloodhound and Neo4j to produce an actionable list of attack paths for targeted remediation.

AsmHalosGate. x64 Assembly HalosGate direct System Caller to evade EDR UserLand hooks

EopMon. Elevation of privilege detector based on HyperPlatform

ChromeTools. A collection of tools to abuse chrome browser

Hook_API. Assembly block for hooking windows API functions.

EfiGuard. Disable PatchGuard and DSE at boot time

ReflectiveDLLRefresher. Universal Unhooking

KaynLdr. KaynLdr is a Reflective Loader written in C/ASM

DefenderSwitch. Stop Windows Defender using the Win32 API

Windows-API-Hashing. This is a simple example and explanation of obfuscating API resolution via hashing

RemoteWriteMonitor. A tool to help malware analysts tell that the sample is injecting code into other process.

delete2SYSTEM. Weaponizing for Arbitrary Files/Directories Delete bugs to Get NT AUTHORITY\SYSTEM

Nobelium-PdfDLRunAesShellcode. A recreation of the "Nobelium" malware based on Microsofts Malware analysis - Part 1: PDF2Pwn

XOREncryption. XOR encryption implementations for several languages.

cypheroth. Automated, extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets.

PR0CESS. some gadgets about windows process and ready to use :)

Mapping-Injection. Just another Windows Process Injection

Eventlogedit-evtx--Evolution. Remove individual lines from Windows XML Event Log (EVTX) files

brown-bags. C#

SyscallAmsiScanBufferBypass. AmsiScanBufferBypass using D/Invoke

BeaconHunter. Detect and respond to Cobalt Strike beacons using ETW.

EDRs. C

PrivFu. Kernel mode WinDbg extension and PoCs for token privilege investigation.

TitanLdr. Titan: A crappy Reflective Loader written in C and assembly for Cobalt Strike. Redirects DNS Beacon over DoH

Shark. Turn off PatchGuard in real time for win7 (7600) ~ later

mal_unpack. Dynamic unpacker based on PE-sieve

SharpNamedPipePTH. Pass the Hash to a named pipe for token Impersonation

BeaconEye. Hunts out CobaltStrike beacons and logs operator command output

SharpNoPSExec. Get file less command execution for lateral movement.

building-c2-implants-in-cpp. The source code files that accompany the short book "Building C2 Implants in C++: A Primer" by Steven Patterson (@shogunlab).

CSharpMusings. Collection of random C# tooling

GRAT2. We developed GRAT2 Command & Control (C2) project for learning purpose.

Sealighter. Sysmon-Like research tool for ETW

RunPE-In-Memory. Run a Exe File (PE Module) in memory (like an Application Loader)

GadgetToJScript. A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts.

InfinityHook. Hook system calls, context switches, page faults and more.

luckystrike. A PowerShell based utility for the creation of malicious Office macro documents.

Azure-Sentinel. Cloud-native SIEM for intelligent security analytics for your entire enterprise.

Zolom. C# Executable with embedded Python that can be used reflectively to run python code on systems without Python installed

ColdHook. A simple open source memory hooking library for Windows x86/x64

DefensiveInjector. C

CobaltStrike-ToolKit. Some useful scripts for CobaltStrike

NTHASH-FPC. Pascal