Swifto0

Swifto0's Stars

• mandiant/capa

  The FLARE team's open-source tool to identify capabilities in executable files.

  Language:Python4.8k821k557

• ossec/ossec-hids

  OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

  Language:C4.5k3291k1k

• AxtMueller/Windows-Kernel-Explorer

  A free but powerful Windows kernel research tool.

  2.4k1070571

• ysrc/yulong-hids-archived

  [archived] 一款实验性质的主机入侵检测系统

  Language:Go2.2k9166581

• hasherezade/hollows_hunter

  Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

  Language:C2k6515253

• Dec0ne/KrbRelayUp

  KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings).

  Language:C#1.5k2323202

• boku7/BokuLoader

  A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!

  Language:C1.3k2612244

• R4gd0ll/I-Wanna-Get-All

  OA漏洞利用工具

  1.1k162784

• Meckazin/ChromeKatz

  Dump cookies and credentials directly from Chrome/Edge process memory

  Language:C++1k1212102

• SpenserCai/DRat

  去中心化远程控制工具（Decentralized Remote Administration Tool），通过ENS实现了配置文件分发的去中心化，通过Telegram实现了服务端的去中心化

  Language:Go7878553

• mandiant/SilkETW

  Language:C#7324315122

• Idov31/FunctionStomping

  Shellcode injection technique. Given as C++ header, standalone Rust program or library.

  Language:Rust68518897

• microsoft/krabsetw

  KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.

  Language:C++60440120149

• EBWi11/AgentSmith-HIDS

  By Kprobe technology Open Source Host-based Intrusion Detection System(HIDS), from E_Bwill.

  5892913166

• vxCrypt0r/Voidgate

  A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes (such as msfvenom) by performing on-the-fly decryption of individual encrypted assembly instructions, thus rendering memory scanners useless for that specific memory page.

  Language:C++4676275

• TonyChen56/ShellCodeFrame

  使用纯C/C++编写的ShellCode生成框架

  Language:C++43284147

• Pizz33/JoJoLoader

  助力红队成员一键生成免杀木马，使用rust实现 | Help Redteam members generate Evasive Anti-virus software Trojan

  Language:Rust4196963

• 0x4D31/galah

  Galah: An LLM-powered web honeypot.

  Language:Go40781238

• yangzhongke/Zack.DotNetTrimmer

  Language:C#36362539

• HackerCalico/Magic_C2

  红队 C2 框架，使用 No X Loader 技术。Red Team C2 Framework, using No X Loader technology.

  Language:C++2756955

• senzee1984/EDRPrison

  Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry

  Language:C#2744130

• M01N-Team/HeaderLessPE

  Language:C2377031

• zodiacon/WFPExplorer

  Windows Filtering Platform Explorer

  Language:C++2087534

• AlteredSecurity/Disable-TamperProtection

  A POC to disable TamperProtection and other Defender / MDE components

  Language:C++1783133

• ProcessusT/ETWMonitor

  Windows notifier tool that detects suspicious connections by monitoring ETW event logs

  Language:PHP1153110

• jdu2600/CFG-FindHiddenShellcode

  Walks the CFG bitmap to find previously executable but currently hidden shellcode regions

  Language:C++994112

• jdu2600/EtwTi-FluctuationMonitor

  Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections

  Language:C++953010

• jdu2600/Etw-SyscallMonitor

  Monitors ETW for security relevant syscalls maintaining the set called by each unique process

  Language:C#49105

• Saber-CC/Go-NKN-Trojan

  A decentralized basic Trojan framework that eliminates C2 mode and is implemented by P2P, the core networking technology of blockchain

  Language:Go32207

• Aterror2be/CVE-2020-14974

  A simple POC that demonstrates A vulnerability found in IObitUnlocker 1.1.2 that leverages IOCTL codes found it its vulnerable driver (IObitUnlocker.sys), providing ability to unlock, delete, rename, copy, and move running files and a low privileged user.

  Language:C++6101