RawHive

RawHive RawHive is a Cobalt Strike BOF for pulling selected Windows registry hives directly from a raw NTFS volume. It skips the normal file APIs, walks NTFS metadata to find the target file records, and copies the bytes straight from disk. It currently looks for: C:\Windows\System32\config\SAM...

CVE-2020-1472-Easy

CVE-2020-1472-Easy This is definitely not something you would want to run on anything that you care about. Built from a writeup and work from @obfuscatee and another source Uses code from https://github.com/dirkjanm/CVE-2020-1472 https://github.com/SecuraBV/CVE-2020-1472...

dfir-toolkit

!CAUTION DFIR Toolkit is leaving github Why? We believe that all men and women, and all human between and above are created equal. In this mindset, it does not make sense to judge people based on their birthplace, or their language, color, religion, or whatsoever. We believe that who you are is...