A core challenge for threat detection engineering is reproducing common attacker behavior. Several open source and commercial projects exist for traditional endpoint and on-premise security, but there is a clear need for a cloud-native tool built with cloud providers and infrastructure in mind

Extract LSASS credentials directly from physical memory by abusing signed vulnerable drivers with physical memory read primitives via MmMapIoSpace, bypassing traditional user-mode detection capabilities

One malicious formula can turn a spreadsheet into a Remote Code Execution (RCE) beachhead. This sandbox escape lets a formula author execute OS commands or run host‑runtime JavaScript, collapsing the boundary between “cell logic” and host execution

curl -sL https://raw.githubusercontent.com/v9mirza/lazyports/main/install.sh | bash

This year, the community nominated 63 pieces of research as contenders. This is significantly fewer than the crazy 121 submissions last time, possibly because we collectively got distracted by AI. That said, it's back in line with historical nomination numbers from 2022 and 2023

Originally featured in the lehack 2025 CTF, this lab is now available for free to everyone! In this lab, you’ll explore how to use the powerful tool NetExec to efficiently compromise an Active Directory domain during an internal pentest.

The ultimate goal? Become Domain Administrator by following various attack paths, using nothing but NetExec! and Maybe BloodHound (Why not?)

Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation

This repository only uses the features that have already been implemented by Microsoft in Windows OS to fine-tune it towards the highest security and locked-down state, without relying on any 3rd party component or dependency, using well-documented, supported, recommended and official methods. Continue reading for comprehensive info

winget install --id 9p7ggfl7dx57 --exact --accept-package-agreements --accept-source-agreements --force --source msstore

curl -L https://ghst.ly/getbhce | docker compose -f - up

http://localhost:8080/ui/login

docker compose pull && docker compose up

python3 bloodhound-python -u domain_user -p 'P@ss' -ns 10.0.0.1 -d contoso.com -c all --dns-tcp

# Domain Admins и время установки пароля
MATCH (g:Group) WHERE g.name =~ "(?i).*DOMAIN ADMINS.*" WITH g MATCH (g)<-
[r:MemberOf*1..]-(u) RETURN u.name AS User,
datetime({epochSeconds:toInteger(u.pwdlastset)}) as passwordLastSet, datetime({epochSeconds: toInteger(u.whencreated)}) AS dateCreated ORDER BY u.pwdlastset

# Сервисные УЗ, время установки пароля, дата создания
MATCH (u:User) WHERE u.hasspn=true AND (NOT u.name STARTS WITH 'KRBTGT') RETURN u.name
AS accountName, datetime({epochSeconds: toInteger(u.pwdlastset)}) AS passwordLastSet,
datetime({epochSeconds: toInteger(u.whencreated)}) AS dateCreated ORDER BY u.pwdlastset

# Пользователи и описание
MATCH (u:User) RETURN u.name as username, u.description as description

# Domain Admins или Administrators с сессией исключая DC
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-516' WITH
COLLECT(c1.name) AS domainControllers
MATCH (n:User)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-512' OR
g.objectid ENDS WITH '-544'
MATCH p = (c:Computer)-[:HasSession]->(n) WHERE NOT c.name in domainControllers return
p

# Неограниченное делегирование исключая DC
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-516' WITH
COLLECT(c1.name) AS domainControllers
MATCH (c:Computer {unconstraineddelegation:true}) WHERE NOT c.name IN domainControllers
RETURN c

# Пользователи с ограниченным делегированием
MATCH p = ((u:User)-[r:AllowedToDelegate]->(c:Computer)) RETURN p

Native Windows toolkit for AD CS enumeration and exploitation. Everything runs through built-in OS components (certreq.exe, certutil.exe, PowerShell AD module, .NET Framework) - no third-party tools needed. Build with a sprinkle of FAFO and some finding out in lab env

🐥adcs-common.ps1
🐥Invoke-Enumerate.ps1
🐥Invoke-SnapshotAudit.ps1
🐥Invoke-RemoteAudit.ps1
🐥Invoke-ESC1.ps1 .. Invoke-ESC13.ps1
🐥Invoke-FindTemplates.ps1
🐥Invoke-PassTheCert.ps1
🐥Invoke-ShadowCredentials.ps1
🐥Invoke-Kerberoast.ps1
🐥Invoke-DomainRecon.ps1