lolcerts: A repository of code signing certificates known to have been leaked or stolen, then abused by threat actors
https://github.com/WithSecureLabs/lolcerts
https://github.com/WithSecureLabs/lolcerts
Collection of notes, useful resources, list of tools and scripts related to Threat Detection & Incident Response
https://github.com/Jean-Francois-C/Threat-Detection-and-Incident-Response
https://github.com/Jean-Francois-C/Threat-Detection-and-Incident-Response
NidhoggScript: is a tool to generate "script" file that allows execution of multiple commands for Nidhogg
https://github.com/Idov31/NidhoggScript
https://github.com/Idov31/NidhoggScript
WERPersistence: This repository showcases a method that ingeniously exploits Windows Error Reporting (WER) for the purpose of stealthy data persistence and evasion. By embedding malicious payloads within WER reports
https://github.com/0xHossam/WERPersistence
https://github.com/0xHossam/WERPersistence
A Beginner’s Guide to Tracking Malware Infrastructure
https://censys.com/a-beginners-guide-to-tracking-malware-infrastructure
https://censys.com/a-beginners-guide-to-tracking-malware-infrastructure
APT29’s Attack on Microsoft: Tracking Cozy Bear’s Footprints
https://www.cyberark.com/resources/blog/apt29s-attack-on-microsoft-tracking-cozy-bears-footprints
https://www.cyberark.com/resources/blog/apt29s-attack-on-microsoft-tracking-cozy-bears-footprints
Real profit
WERPersistence: This repository showcases a method that ingeniously exploits Windows Error Reporting (WER) for the purpose of stealthy data persistence and evasion. By embedding malicious payloads within WER reports https://github.com/0xHossam/WERPersistence
WERPersistence.zip
365.6 KB
Leveraging Windows Error Reporting (WER) for Stealthy Data Persistence & Evasion
https://github.com/Mmo23/WERPersistence
https://github.com/Mmo23/WERPersistence
Remote buffer overflow over wifi_stack in wpa_supplicant binary in android 11, platform:samsung a20e, stock options so like works out of the box
https://github.com/SpiralBL0CK/Remote-buffer-overflow-over-wifi_stack-in-wpa_supplicant-binary-in-android-11-platform-samsung-a20e
https://github.com/SpiralBL0CK/Remote-buffer-overflow-over-wifi_stack-in-wpa_supplicant-binary-in-android-11-platform-samsung-a20e
Bypassing EDRs With EDR-Preloading
https://malwaretech.com/2024/02/bypassing-edrs-with-edr-preload
https://malwaretech.com/2024/02/bypassing-edrs-with-edr-preload
Reflective DLL got Indirect Syscall skills
https://oldboy21.github.io/posts/2024/02/reflective-dll-got-indirect-syscall-skills
https://oldboy21.github.io/posts/2024/02/reflective-dll-got-indirect-syscall-skills
Real profit
Bypassing EDRs With EDR-Preloading https://malwaretech.com/2024/02/bypassing-edrs-with-edr-preload
EDR-Preloader: An EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer
https://github.com/MalwareTech/EDR-Preloader
https://github.com/MalwareTech/EDR-Preloader
MDE-Tester: is designed to help testing various features in Microsoft Defender for Endpoint
https://github.com/LearningKijo/MDEtester
https://github.com/LearningKijo/MDEtester
Dump cookies directly from Chrome process memory
https://github.com/Meckazin/ChromeKatz
https://github.com/Meckazin/ChromeKatz
CVE-2024-23724: Ghost CMS Stored XSS Leading to Owner Takeover
https://rhinosecuritylabs.com/research/cve-2024-23724-ghost-cms-stored-xss
https://rhinosecuritylabs.com/research/cve-2024-23724-ghost-cms-stored-xss
NetHunter Hacker XIII: Overall guide to MITM framework
https://www.mobile-hacker.com/2024/02/13/nethunter-hacker-xiii-overall-guide-to-mitm-framework
https://www.mobile-hacker.com/2024/02/13/nethunter-hacker-xiii-overall-guide-to-mitm-framework
Offensive Lab Environments (Without the Suck)
https://trustedsec.com/blog/offensive-lab-environments-without-the-suck
https://trustedsec.com/blog/offensive-lab-environments-without-the-suck
Collection of UAC Bypass Techniques Weaponized as BOFs
https://github.com/icyguider/UAC-BOF-Bonanza
https://github.com/icyguider/UAC-BOF-Bonanza
CrimsonEDR: Simulate the behavior of AV/EDR for malware development training
https://github.com/Helixo32/CrimsonEDR
https://github.com/Helixo32/CrimsonEDR
RCE PoC for Empire C2 framework <5.9.3
https://github.com/ACE-Responder/Empire-C2-RCE-PoC
CVE-2024-21413 Microsoft Outlook Information Disclosure Vulnerability (leak password hash) Expect Script PoC
https://github.com/duy-31/CVE-2024-21413
https://github.com/ACE-Responder/Empire-C2-RCE-PoC
CVE-2024-21413 Microsoft Outlook Information Disclosure Vulnerability (leak password hash) Expect Script PoC
https://github.com/duy-31/CVE-2024-21413
Hunting M365 Invaders: Navigating the Shadows of Midnight Blizzard
https://www.splunk.com/en_us/blog/security/hunting-m365-invaders-navigating-the-shadows-of-midnight-blizzard
https://www.splunk.com/en_us/blog/security/hunting-m365-invaders-navigating-the-shadows-of-midnight-blizzard
MacOS CI/CD with Tart
https://medium.com/snowflake/macos-ci-cd-with-tart-d3c0e511f3c9
https://medium.com/snowflake/macos-ci-cd-with-tart-d3c0e511f3c9