swarmer

swarmer EDR/AVから隠れてHKCUにレジストリキーを追加するためのツールです。管理者権限がなくても動作します。 使用方法 注意: この操作は一度だけ実行できます。NTUSER.MANが新しいレジストリハイブになった後は、管理者でなければ変更できません。最初の実行で必要な変更をすべて確実に行ってください。 regquery BOFの結果を使用する場合 1. 適切な reqquery BOFを https://github.com/trustedsec/CS-Situational-Awareness-BOF/tree/master/SA/regquery から入手します。 2...

SharpStay

SharpStay - .NET 永続化 ビルド コンパイルするには Visual Studio プロジェクトを開き、リリース用にコンパイルします。 オプション 昇格した権限のレジストリキー 昇格した権限の UserInit レジストリキー 昇格した権限のスケジュールタスク 昇格した権限のサービス作成 昇格した権限の WMI イベントサブスクリプション 非昇格 InitMprLogonScript レジストリキー 非昇格スケジュールタスク COM ハンドラーハイジャック 非昇格ジャンクションフォルダ その他 スケジュールタスクアクション追加 その他 スタートアップディレクトリ その他 新...

Fix-CVE-2023-36884

Fix-CVE-2023-36884.ps1 用于缓解 CVE-2023-36884 漏洞的临时解决方案。 此漏洞影响 Windows 操作系统，可能允许远程执行恶意代码。 CVE-2023-36884 » CVE-2023-36884 CVE-2023-36884 漏洞是一个严重的安全缺陷，可能导致 Windows 系统上的远程代码执行。微软尚未发布更新来修复此问题。然而，他们指导创建一些注册表项来规避该问题，直到提供最终解决方案为止。 解决方案 - Fix-CVE-2023-36884.ps1 我们，来自...

persistence-info.github.io

该仓库旨在收集有关 Windows 持久化机制的信息，以使防护/检测更加高效。其中大部分信息多年来已广为人知，并在各种场景中被积极使用。 敬请期待更多。我会尽最大努力每天添加新条目。 工作原理及如何参与贡献。 👨‍💼 HKCU 的 Run 和 RunOnce 注册表项 👨‍💼 ⚙ 任务计划程序 ⚙ 映像文件执行选项注册表项 ⚙ Windows 服务 AeDebug WER 调试器 ⚙ 自然语言开发平台 6 的 DLL ⚙ GPO 客户端扩展 ⚙ 用于 Windows 搜索的筛选处理程序 磁盘清理处理程序 👨‍💼 .chm 辅助 DLL hhctrl.ocx ⚙ AMSI 提供程序 ⚙...

VMwareCloak

VMwareCloak Un script de PowerShell que intenta ayudar a los analistas de malware a ocultar sus máquinas virtuales VMware de Windows del malware que pueda estar intentando evadir el análisis. Garantizado para bajar tus puntuaciones en pafish por al menos algunos puntos ; El script logra esto...

EUVD-2025-210211

Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing the NSClient Tamper Protections due to weak Discretionary Access Control List DACLs on the service object and related registry keys,. Produc...

CVE-2025-15642

Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing the NSClient Tamper Protections due to weak Discretionary Access Control List DACLs on the service object and related registry keys,. Produc...

ATBroker Registry Security Scanner

This code is a defensive Windows security scanner designed to audit potentially sensitive Registry paths related to ATBroker Accessibility Technology Broker and core system hives. It only checks for the presence of certain registry keys to see if they're protected or accessible...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the...

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Impact On Windows, app.setAsDefaultProtocolClientprotocol did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\Software\Classes, potentially hijacking existing protocol...

CVE-2026-1716

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to delete arbitrary registry keys with elevated privileges...

CVE-2026-1715

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to modify arbitrary registry keys with elevated privileges...

NVIDIA B300 MCU 安全漏洞

NVIDIA B300 MCU is a micro-control unit component developed by NVIDIA Corporation, used for managing and controlling hardware devices. The NVIDIA B300 MCU has a security vulnerability; this vulnerability stems from the CX8 MCU allowing modifications to unsupported registry keys, which may lead to...

Exploit for Incorrect Permission Assignment for Critical Resource in Microsoft

RegPwn BOF for Brute Ratel C4 My Brute Ratel C4 BOF reimpleme...

Microsoft Windows Image File Execution Options (IFEO) Persistence

This PHP script leverages legitimate Windows debugging features to establish persistent remote access. This technique leverages the Image File Execution Options IFEO registry keys to configure a monitor process that automatically executes when a specified target process exits. Windows allows...

EUVD-2026-11359

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to delete arbitrary registry keys with elevated privileges...

EUVD-2026-11357

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to modify arbitrary registry keys with elevated privileges...

CVE-2026-1716

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to delete arbitrary registry keys with elevated privileges...

CVE-2026-1715

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to modify arbitrary registry keys with elevated privileges...

CVE-2026-1716

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to delete arbitrary registry keys with elevated privileges...