Sysmon gets its DNS telemetry from the Microsoft-Windows-DNS-Client ETW provider.
Let's hide in plain sight.

LSA secrets extraction, reuse a preexisting VSS shadow copy + inline regf parser + AES-256 LSA decrypt via bcrypt.dll.

$ curl -fsSL https://opentunnel.xyz/install | sh

$ opentunnel route add 47365
creating tunnel... tunnel is ready.
added route 3e9b1c07a4d25f86 → 127.0.0.1:47365
https://3e9b1c07a4d25f86.f7a2mx4kq9vn.opentunnel.xyz

$ curl https://3e9b1c07a4d25f86.f7a2mx4kq9vn.opentunnel.xyz
hello from localhost:47365

A web canvas where you build infrastructure as a topology, then export a complete, runnable working directory of Terraform and Ansible. You run it from your own machine. redStackPRO never holds your cloud credentials.

Modern strace and real-time Process Monitor for Windows. Built in native Rust with zero kernel drivers required, featuring a real-time terminal user interface (TUI) and unbuffered streaming for headless diagnostics.

A python tool to assist in your payloads classification against EDR/AV's machine learning models. Originally inspired by @0xTriboulet's (https://github.com/0xTriboulet) talk at 44con about evading the machine classifier.

Abuses the Credential Provider COM interface to steal plaintext passwords from logonui.exe via CredProvDataModel.dll hooks

A Windows credential stealer implemented as a rogue Credential Provider DLL. It loads automatically into logonui.exe via COM registration (bypassing PPL) and hooks CredProvDataModel.dll to capture plaintext passwords at the Windows logon and lock screen