crimsoncore's Stars
secure-cake/rapid-endpoint-investigations
Scripts for rapid Windows endpoint "tactical triage" and investigations with Velociraptor and KAPE
wavestone-cdt/EDRSandblast
antonioCoco/RogueWinRM
Windows Local Privilege Escalation from Service Account to System
antonioCoco/RoguePotato
Another Windows Local Privilege Escalation from Service Account to System
Kevin-Robertson/Inveigh
.NET IPv4/IPv6 machine-in-the-middle tool for penetration testers
monoxgas/sRDI
Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode
pcgeek86/PowerEvents
PowerEvents is a PowerShell module that assists in the registration of WMI permanent event subscriptions.
0xthirteen/SharpRDP
Remote Desktop Protocol .NET Console Application for Authenticated Command Execution
rasta-mouse/ThreatCheck
Identifies the bytes that Microsoft Defender / AMSI Consumer flags on.
nettitude/PoshC2
A proxy aware C2 framework used to aid red teamers with post-exploitation and lateral movement.
PwnDexter/SharpEDRChecker
Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services and each service binaries metadata, installed drivers and each drivers metadata, all for the presence of known defensive products such as AV's, EDR's and logging tools.
PwnDexter/Invoke-EDRChecker
Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services, the registry and running drivers for the presence of known defensive products such as AV's, EDR's and logging tools.
crimsoncore/ShellcodeWrapper
Shellcode wrapper with encryption for multiple target languages
pandasec888/taowu-cobalt_strike
RedSiege/WMImplant
This is a PowerShell based tool that is designed to act like a RAT. Its interface is that of a shell where any command that is supported is translated into a WMI-equivalent for use on a network/remote machine. WMImplant is WMI based.
samratashok/ADModule
Microsoft signed ActiveDirectory PowerShell module
ION28/BLUESPAWN
An Active Defense and EDR software to empower Blue Teams
ropnop/windapsearch
Python script to enumerate users, groups and computers from a Windows domain through LDAP queries
zeek/zeek-docker
Docker files for building Zeek.
ahmedkhlief/Ninja
Open source C2 server created for stealth red team operations
TheHive-Project/Cortex
Cortex: a Powerful Observable Analysis and Active Response Engine
crimsoncore/threathunt
crimsoncore/docker_mdbook
crimsoncore/BadBlood
BadBlood by Secframe fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active Directory. Each time this tool runs, it produces different results. The domain, users, groups, computers and permissions are different. Every. Single. Time.