pat_h/to/file

bad-bpf. A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29

Sealighter. Sysmon-Like research tool for ETW

SealighterTI. Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider

PPLRunner. Run Processes as PPL with ELAM

bpf-hookdetect. Dectect syscall hooking using eBPF

siemcraft. Security Information and Event Management in Minecraft

commandline_cloaking. A collection of projects demonstrating various commandline cloaking techniques on Linux

bpf-pipesnoop. Example program using eBPF to log data being based in using shell pipes

tf_wireguard. Simple Terraform Scripts to setup a WireGuard server on various cloud providers.

SimpleAmsiProvider. A simple provider to analyse what gets passed into Microsoft's Anti-Malware Scan Interface

toucli. Use TouchID and the Secure Enclave to encrypt data from the commandline.

ios_configuration_profiles. This repo contains the parsed PList data from [Apple's Developer Configuration Profiles](https://developer.apple.com/bug-reporting/profiles-and-logs/?platform=ios).

ctlwatcher. Monitor Certificate Transparency logs for domains matching regexes.

https.server. Python SimpleHTTPServer wrapped in TLS

bpf-uprobedbg. C

ld_preload_go. Simple example of creating an `LD_PRELOAD` library in Go that hooks LibC's main function.

cookiecache. Simplify getting and using cookies from the browser to use in Python.

ebpf-pinned-fentry. Example how to run eBPF probes without a usermode process using fentry

etw_watcher. Using GitHub Actions to create commit diffs

terraform-provider-bitlaunch. BitLaunch Terraform Provider

Presentations. A Repo to hold slides from presentations, etc.

etwRunner. Basic KrabsETW runner template

PowerInject. Inject Interactive PowerShell into an arbitrary process

dockenv. Dockenv - Run python in docker the easy way

sgproxy. Basic HTTP/S proxy. Created to add HTTP Auth to a request from a client that doesn't support supplying auth in URL, for example VScode's Juypyter Notebook Server browser.

sigstore-watcher. Watches SigStore Code Signing Logs

etrace. strace-like logging using bpftrace and eBPF

Puppeteer-Stealth-Docker. This is a simple example of how do stealthy headless chrome webscraping from a Docker container.

pyauditlogger. Auto-Add Python 3.8 audit hooks to all python scripts

hijack-watcher. Rust version of HijackWatcher

volatility2-profile-ubuntu2104. A Profile for Volatility 2 Matching Ubuntu 21.04

Import-Scanner. This tool scans all PEs in a directory for the import `CveEventWrite`, a new function that Writes CVE details to ETW and the Event Log