crimsoncore

crimsoncore's Stars

• secure-cake/rapid-endpoint-investigations

  Scripts for rapid Windows endpoint "tactical triage" and investigations with Velociraptor and KAPE

  Language:PowerShell9417

• wavestone-cdt/EDRSandblast

  Language:C1.4k271

• antonioCoco/RogueWinRM

  Windows Local Privilege Escalation from Service Account to System

  Language:C++665101

• antonioCoco/RoguePotato

  Another Windows Local Privilege Escalation from Service Account to System

  Language:C1k128

• Kevin-Robertson/Inveigh

  .NET IPv4/IPv6 machine-in-the-middle tool for penetration testers

  Language:C#2.5k439

• monoxgas/sRDI

  Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

  Language:PowerShell2.1k456

• pcgeek86/PowerEvents

  PowerEvents is a PowerShell module that assists in the registration of WMI permanent event subscriptions.

  Language:PowerShell648

• 0xthirteen/SharpRDP

  Remote Desktop Protocol .NET Console Application for Authenticated Command Execution

  Language:C#979502

• rasta-mouse/ThreatCheck

  Identifies the bytes that Microsoft Defender / AMSI Consumer flags on.

  Language:C#1k114

• nettitude/PoshC2

  A proxy aware C2 framework used to aid red teamers with post-exploitation and lateral movement.

  Language:PowerShell1.8k322

• PwnDexter/SharpEDRChecker

  Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services and each service binaries metadata, installed drivers and each drivers metadata, all for the presence of known defensive products such as AV's, EDR's and logging tools.

  Language:C#67494

• PwnDexter/Invoke-EDRChecker

  Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services, the registry and running drivers for the presence of known defensive products such as AV's, EDR's and logging tools.

  Language:PowerShell23248

• crimsoncore/ShellcodeWrapper

  Shellcode wrapper with encryption for multiple target languages

  1

• pandasec888/taowu-cobalt_strike

  1.8k332

• RedSiege/WMImplant

  This is a PowerShell based tool that is designed to act like a RAT. Its interface is that of a shell where any command that is supported is translated into a WMI-equivalent for use on a network/remote machine. WMImplant is WMI based.

  Language:PowerShell798143

• samratashok/ADModule

  Microsoft signed ActiveDirectory PowerShell module

  Language:PowerShell826195

• ION28/BLUESPAWN

  An Active Defense and EDR software to empower Blue Teams

  Language:C++1.2k167

• ropnop/windapsearch

  Python script to enumerate users, groups and computers from a Windows domain through LDAP queries

  Language:Python770149

• zeek/zeek-docker

  Docker files for building Zeek.

  Language:Dockerfile8534

• ahmedkhlief/Ninja

  Open source C2 server created for stealth red team operations

  Language:PowerShell768168

• TheHive-Project/Cortex

  Cortex: a Powerful Observable Analysis and Active Response Engine

  Language:Scala1.3k222

• crimsoncore/threathunt

  Language:PowerShell21

• crimsoncore/docker_mdbook

  Language:Dockerfile1

• crimsoncore/BadBlood

  BadBlood by Secframe fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active Directory. Each time this tool runs, it produces different results. The domain, users, groups, computers and permissions are different. Every. Single. Time.

  1