robinfassinamoschiniforks Goto Github PK

falconfriday

Bi-weekly hunting queries

farmer

flipperzero-firmware-unleashed

Flipper Zero Code-Grabber Firmware

foliage

Experiment on reproducing Obfuscate & Sleep

foliage-1

Public variation of FOLIAGE ( original developer )

freebokuloader

A simple BOF that frees UDRLs

freeze

Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods

fwexpl

PC firmware exploitation tool and library

gargoyle

A memory scanning evasion technique

gcti

goad

game of active directory

gpusleep

Move CS beacon to GPU memory when sleeping

hacksysextremevulnerabledriver

HackSys Extreme Vulnerable Windows Driver

hacktricks-cloud

halosgate-ps

Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes

havoc

The Havoc Framework

havoc-py

Havoc python api

havocframework-modules

Modules used by the Havoc Framework

hellhall

Performing Indirect Clean Syscalls

hellsgate

Original C Implementation of the Hell's Gate VX Technique

hellsgateppid

Assembly HellGate implementation that directly calls Windows System Calls and displays the PPID of the explorer.exe process

hollow

EarlyBird process hollowing technique (BOF) - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and execute shellcode

hollows_hunter

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

hunt-sleeping-beacons

Aims to identify sleeping beacons

hw-call-stack

Use hardware breakpoints to spoof the call stack for both syscalls and API calls

hwbp4mw

hwsyscalls

HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.

impacket

Impacket is a collection of Python classes for working with network protocols.

improvedreflectivedllinjection

An improvement of the original reflective DLL injection technique by Stephen Fewer of Harmony Security

inceptor

Template-Driven AV/EDR Evasion Framework