faanross

faanross's Stars

• winsiderss/systeminformer

  A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ http://www.windows-internals.com

  Language:C11.6k2841.7k1.4k

• LordNoteworthy/al-khaser

  Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

  Language:C++5.9k2421021.2k

• byt3bl33d3r/OffensiveNim

  My experiments in weaponizing Nim (https://nim-lang.org/)

  Language:Nim2.9k6930355

• hasherezade/pe_to_shellcode

  Converts PE into a shellcode

  Language:C++2.5k5439447

• hasherezade/malware_training_vol1

  Materials for Windows Malware Analysis training (volume 1)

  Language:Assembly2k15121194

• ThreatHuntingProject/ThreatHunting

  An informational repo about hunting for adversaries in your IT environment.

  1.8k2264378

• aahmad097/AlternativeShellcodeExec

  Alternative Shellcode Execution Via Callbacks

  Language:C++1.5k422309

• jstrosch/malware-samples

  Malware samples, analysis exercises and other interesting resources.

  Language:HTML1.5k890231

• FoxIO-LLC/ja4

  JA4+ is a suite of network fingerprinting standards

  Language:Rust1.2k2593106

• winsiderss/phnt

  Native API header files for the System Informer project.

  Language:C1.1k3923181

• SafeBreach-Labs/PoolParty

  A set of fully-undetectable process injection techniques abusing Windows Thread Pools

  Language:C++1.1k173144

• werkamsus/Lilith

  Lilith - Foundational reverse engineering resource for cybersecurity entrepreneurs in C++

  Language:C++7275325210

• RCStep/CSSG

  Cobalt Strike Shellcode Generator

  Language:C#654114111

• codewhitesec/HandleKatz

  PIC lsass dumper using cloned handles

  Language:C580126103

• umutcamliyurt/PingRAT

  PingRAT secretly passes C2 traffic through firewalls using ICMP payloads.

  Language:Go4125254

• 0xEr3bus/PoolPartyBof

  A beacon object file implementation of PoolParty Process Injection Technique.

  Language:C3735244

• shogunlab/building-c2-implants-in-cpp

  The source code files that accompany the short book "Building C2 Implants in C++: A Primer" by Steven Patterson (@shogun_lab).

  Language:C++2269241

• ZeroMemoryEx/Handle-Ripper

  simple Windows handle hijacker with a nod to Apxaey for inspiration

  Language:C++2017029

• trustedsec/specula

  Language:Python1903421

• jconwell/secret_handshake

  A prototype malware C2 channel using x509 certificates over mTLS

  Language:Python1533214

• gharty03/Conti-Ransomware

  Full source of the Conti Ransomware Including the missing Locker files from the original leak. I have fixed some of the errors intentionally introduced by the leaker to prevent the locker from being built. The Queue header file which implements a few linked list data structures that Conti uses for task scheduling in the Threadpool had several missing commas, there are still errors which I believe to be the result of a missing #ifdef pre-processsor macro in one of the header files but haven't had time to find it. Will be uploading English Translated Documentation In the future

  Language:C++1333038

• JLospinoso/cpp-implant

  A simple implant showcasing modern C++

  Language:C++1068026

• MSxDOS/ntapi

  Rust FFI bindings for Native API

  Language:Rust10251034

• yottaawesome/programming-windows-5th-edition

  Unofficial source code repo for Charles Petzold's Programming Windows 5th Edition.

  Language:C893439

• wsummerhill/CSharp-Alt-Shellcode-Callbacks

  A collection of (even more) alternative shellcode callback methods in CSharp

  Language:C#693027

• zodiacon/winnativeapibooksamples

  Samples from my book Windows Native API programming

  Language:C++604015

• agreenjay/sysmon

  A collection of useful PowerShell tools to collect, organize, and visualize Sysmon event data

  Language:PowerShell392011

• stratosphereips/a-study-of-remote-access-trojans

  This repository contains a curated list of papers, articles and other sources related to remote access trojans.

  35668

• S12cybersecurity/RatInject

  Rat Inject is C++ Executable to gain Undetectable Persistence in Windows via 4 Registry Keys

  Language:C++28103

• hemp3l/icmpsh

  Simple Reverse ICMP Shell

  Language:C5202