thefLink

Hunt-Sleeping-Beacons. Aims to identify sleeping beacons

RecycledGate. Hellsgate + Halosgate/Tartarosgate. Ensures that all systemcalls go through ntdll.dll

DeepSleep. A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC

C-To-Shellcode-Examples. C

Hunt-Weird-Syscalls. ETW based POC to identify direct and indirect syscalls

Hunt-Weird-ImageLoads. Small tool to play with IOCs caused by Imageload events

Memfiddler. Executes shellcode from a remote server and aims to evade in-memory scanners

RedTeamCSharpScripts. C# Script used for Red Team

AutoExit. Ensures that a GUI application terminates after processing. Used for Fuzzing

SLAE64. Assembly

mbe. Solutions for mbe class