Handle elevation DKOM against ObRegisterCallbacks

A Beacon Object File (BOF) that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory.

Install Proxmox-VE on Hetzner dedicated-server without KVM console

Advanced Wazuh Rules for more accurate threat detection. Feel free to implement within your own Wazuh environment, contribute, or fork!

Implementation of KlezVirus' silent moonwalk approach for payloads

Linux Sleep Obfuscation

Themida 3.x research

Lightweight fuzzing of a memory snapshot using KVM

a COFF/BOF loader implementation in go, no syscall/windows import

Dump LSASS via physical memory read primitives in vulnerable kernel drivers

BYOVD: Use 360 ​​WFP driver to block EDR/XDR network connection.

Linux kernel integrity monitor for detecting syscall hooking

Project for generating and identifying deceptive LNK files.

SSH man-in-the-middle tool

Proof of Concept (PoC) implant for creating custom Cobalt Strike Beacons

Virtual Trust Level (VTL 1) secure call tracing

PPLReaper is a Windows kernel driver + userland companion tool designed to inspect and manipulate Protected Process Light (PPL) attributes at runtime.

A Rust template for writing Beacon Object Files (BOFs)

Eurydice compiles (a decent subset of) Rust to C. Verify programs in Rust, still get C code for legacy environments.

A stager and implant that executes remote Web Assembly

The first game written and played entirely in Rust's type system. Not only do you play by writing Rust code, but the rules of the game are enforced by the Rust compiler. If you can write the progra…

A kernel level anti-rootkit tool which runs on the windows platform.

🛡️ Open-source binary protection toolkit for Windows PE. Nanomite, VM protection, anti-debug, and more.

A collection of DPAPI hunting and parsing BOFs

A tool to easily perform GitLab Device Code Phishing on red team engagements

ransomware emulation tool for red team exercises and defensive training. implements file encryption using windows bcrypt api with pure winapi calls through go-wincall.

place for me to store various packages i use a lot during development and want to share/don't want to import locally

poc implementation of warbird api abuse to execute shellcode