BestEdrOfTheMarket

Best EDR Of The Market BEOTM V3 🐲🏴‍☠️ Best Edr Of The Market is an open-source lab designed to implement and understand, from a low-level perspective, the detection methods used by Endpoints Detection & Response security products and their workarounds. These techniques are mainly based on the...

SharpEDRChecker

SharpEDRChecker New and improved C Implementation of Invoke-EDRChecker. Checks running processes, process metadata, Dlls loaded into your current process and each DLLs metadata, common install directories, installed services and each service binaries metadata, installed drivers and each drivers...

AggressorScripts

Aggressor Scripts Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources AllInOne.cna v1 - Removed and outdated All purpose script to enhance the user's experience with cobaltstrike. Custom menu creation, Logging, Persistence, Enumeration, and 3rd party script...

EDRHunt

EDRHunt EDRHunt scans Windows services, drivers, processes, registry, wmi for installed EDRs Endpoint Detection And Response. Read more about EDRHunt here. Install Binary Download the latest release from the release section. Releases are built for windows/amd64. Go Requires Go to be installed on...

Invoke-EDRChecker

Invoke-EDRChecker The script will check running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services, the registry and running drivers for the presence of known defensive products such as AV's, EDR's and...

log4j-finder

log4j-finder A Python3 script to scan the filesystem to find Log4j2 that is vulnerable to Log4Shell CVE-2021-44228 & CVE-2021-45046 & CVE-2021-45105. It scans recursively both on disk and inside nested Java Archive files JARs. How it works log4j-finder identifies log4j2 libraries on your filesyst...

BadExclusionsNWBO

BadExclusions Now With Better Opsec BadExclusionsNWBO is an evolution from BadExclusions to identify folder custom or undocumented exclusions on AV/EDR. How it works? BadExclusionsNWBO copies and runs HookChecker.exe in all folders and subfolders of a given path. You need to have HookChecker.exe ...

Neton

Neton - A sandbox information gathering tool Neton is a tool for getting information from Internet connected sandboxes. It is composed by an agent and a web interface that displays the collected information. The Neton agent gets information from the systems on which it runs and exfiltrates it via...

VBA-macro-experiments

VBA macro experiments Collection of VBA macros published in our twitter / blog. If you are interested about this topic, please read our articles "Hacking in an epistolary way: implementing kerberoast in pure VBA" and "Shedding light on creating VBA macros". Also feel free to follow our twitter ;...

Exploit for Use After Free in Adobe Acrobat_Dc

CVE-2020-9715 EDR Validation PoC Use-after-free in Adobe Acro...

Living off the land with Bluetooth PAN

TL:DR Bluetooth is enabled by default on the majority of Windows laptops Bluetooth PAN can be used to bridge connections locally between a client laptop and attacking device Attackers can use Microsoft native SSH client to forward out internal network traffic Windows native SSH is accessible to...