darmado
Follow
Lists (32)
ADVERSARY LANGUAGES
Alternative programming languages used by adversariesAI
APP
C2:Loaders
CHEAT SHEETS
COLLECTION
COMMAND & CONTROL
List of C2 projects we've used at least once during assumed breach, threat emulation, and purple team exercise work.CREDENTIAL ACCESS
CTI ANALYSIS
Tools for automating CTI analysisDEFENSE EVASION
DEVSEC OPS
All things DevSecOpsDISCOVERY
EXECUTION
EXFILTRATION
INITIAL ACCESS
LATERAL MOVEMENT
LEARNING
MacOS
MALDOC
MOBILE
OSINT
PERSISTENCE
PIPELINES
PRIVILEGE ESCALATION
RANSOMWARE SIM
RECON
REPORTING
SMART CONTRACT TOOLS
TOOLS
This list includes offensive operations tooling that includes many TTPsTTP
VULN ANALYSIS
WEB APPS
Open source web appsStars
Small and highly portable detection tests based on MITRE's ATT&CK.
ClamAV - Documentation is here: https://docs.clamav.net
Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
eBPF-based Security Observability and Runtime Enforcement
fake keyboard/mouse input, window management, and more
A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)
Simple (relatively) things allowing you to dig a bit deeper than usual.
A post exploitation framework designed to operate covertly on heavily monitored environments
An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.
Situational Awareness commands implemented using Beacon Object Files
Windows Privilege Escalation from User to Domain Admin.
A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!
Dump cookies and credentials directly from Chrome/Edge process memory
Research code & papers from members of vx-underground.
A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.
Collection of PoC and offensive techniques used by the BlackArrow Red Team
A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.html#dirty-vanity-a-new-approach-to-code-injection--edr-bypass…
Collection of Beacon Object Files (BOF) for Cobalt Strike
Inject .NET assemblies into an existing process
Azure Outlook Command & Control (C2) - Remotely control a compromised Windows Device from your Outlook mailbox. Threat Emulation Tool for North Korean APT InkySquid / ScarCruft / APT37. TTP: Use Mi…
Hellsgate + Halosgate/Tartarosgate. Ensures that all systemcalls go through ntdll.dll
PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.
An other No-Fix LPE, NTLMRelay2Self over HTTP (Webdav).