Popular repositories Loading

1. EDRSilencer EDRSilencer Public

   A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

   C 1.8k 239

2. GhostTask GhostTask Public

   A tool employs direct registry manipulation to create scheduled tasks without triggering the usual event logs.

   C 622 70

3. ScheduleRunner ScheduleRunner Public

   A C# tool with more flexibility to customize scheduled task for both persistence and lateral movement in red team operation

   C# 347 48

4. RDPHijack-BOF RDPHijack-BOF Public

   Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking.

   C 314 47

5. ServiceMove-BOF ServiceMove-BOF Public

   New lateral movement technique by abusing Windows Perception Simulation Service to achieve DLL hijacking code execution.

   C 303 49

6. TrustedPath-UACBypass-BOF TrustedPath-UACBypass-BOF Public

   Cobalt Strike beacon object file implementation for trusted path UAC bypass. The target executable will be called without involving "cmd.exe" by using DCOM object.

   C 146 41