gdid-reversal

Full writeup of the Windows GDID Global Device Identifier fully reverse engineered -8a2be2 -0078d6 How Microsoft's "Global Device Identifier", the persistent Windows fingerprint named in the July 2026 Scattered Spider complaint, is actually generated, stored, and transmitted. TL;DR !NOTE Listed...

ezEmu

ezEmu ezEmu enables users to test adversary behaviors via various execution techniques. Sort of like an "offensive framework for blue teamers ", ezEmu does not have any networking/C2 capabilities and rather focuses on creating local test telemetry. Windows See /Linux for ELF ezEmu is compiled as...

deadair

deadair checks whether enabled SIEM detections still have the telemetry they need. It reports missing or stale data, ingest delays, and schema mismatches. Runs locally · Read-only · No agent · No telemetry upload Read the technical write-up · Featured in Detection Engineering Weekly · Featured in...

LOLSpoof

LOLSpoof LOLSpoof is a an interactive shell program that automatically spoof the command line arguments of the spawned process. Just call your incriminate-looking command line LOLBin e.g. powershell -w hidden -enc ZwBlAHQALQBwAHIAbwBjAGUA.... and LOLSpoof will ensure that the process creation...

macnoise

MacNoise MacNoise generates real macOS activity for EDR validation and detection engineering. Run individual modules or YAML scenarios to exercise network connections, file writes, process execution, persistence, TCC access, and other behaviors against your security controls. For background on th...

Project-Onyx

Project Onyx Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advanced evasion techniques against modern EDR systems. It shifts away from traditional signature-based obfuscation towards behavioral camouflage and stri...

TelemetrySourcerer

Telemetry Sourcerer Introduction Telemetry Sourcerer can enumerate and disable common sources of telemetry used by AV/EDR on Windows. Red teamers and security enthusiasts can use this tool in a lab environment to: Identify collection-based blind spots in the products they're up against. Determine...

tenzir

Data Pipelines for Security Teams Collect, transform, enrich, and route your telemetry—all in one place. What is Tenzir? Tenzir is the data pipeline engine for security teams. If you need to collect, parse, shape, normalize, aggregate, store, query, and route security telemetry data at scale,...

magnet

Magnet Draw the Signals, Detect the Threats. Abstract Magnet is Purple-team telemetry & simulation toolkit. Purpose: modular, cross-platform eventually generator for telemetry and malicious activity. Why the name? Because this attracts SOC analysts and detection rules! 😜 As a secondary use case,...

EventHorizon

EventHorizon EventHorizon is a tool meant to arm security analysts and/or researchers with Event Tracing for Windows ETW telemetry that, coupled with sigma-like rules, allow for robust endpoint detection and response capabilities. That being said, EventHorizon is in no way a replacement for prope...

systempi

systempi Real-time Raspberry Pi system monitoring dashboard for Linux terminals with live telemetry, hardware health analysis, and low-flicker rendering. FEATURES Real-time CPU, RAM, swap, disk, and network monitoring Raspberry Pi hardware telemetry through vcgencmd Power, throttling, undervoltag...

SuperDiagnosticTool

SuperDiagnosticTool AI-Powered Windows Diagnostic & Remediation Tool SuperDiagnosticTool collects real-time hardware telemetry, sends it to the Google Gemini API for analysis, and generates PowerShell remediation scripts to address detected issues. It includes multiple validation layers that a...

openedr

OpenEDR We at OpenEDR believe in creating a cybersecurity platform with its source code openly available to the public, where products and services can be provisioned and managed together. EDR is our starting point. OpenEDR is a full-blown EDR capability. It is one of the most sophisticated,...

SunnyDayBPF

SunnyDayBPF SunnyDayBPF is an eBPF-based post-syscall user-buffer telemetry deception research technique originally proposed and researched by Azizcan Dastan. The technique investigates whether data observed by user-space security, logging, or telemetry agents can be altered after a read-like...

rustinel

Rustinel Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required. Download | Documentation | Detection packs | Website Why Rustinel? Use Sigma a...

azazel

Azazel A lightweight eBPF-based runtime security tracer purpose-built for malware analysis sandboxes. Drop a sample into an isolated container, and Azazel captures every syscall, file touch, network connection, and suspicious behavior, then hands you a clean JSON stream of everything that happene...

CVE-2021-22005

CVE-2021-22005 VMware vCenter RCE CVE-2021-22005 one-liner mass checker cat vmwarecenters.txt | while read S do; do curl --connect-timeout 15 --max-time 30 --silent --insecure --user-agent "vAPI/2.100.0 Java/1.8.0261 Linux; 4.19.160-6.ph3; amd64" -X POST...

SNEK_Equinox

SNEK Equinox I would like to thank Nightmare-Eclipse for the inspiration not personal from the project UnDefend - https://web.archive.org/web/20260521145157/https://github.com/Nightmare-Eclipse/UnDefend: Now funnily enough, I found a way to lie to the EDR web console to show that defender is up a...

sysflow

SysFlow: Cloud-native system telemetry pipeline This repository hosts the documentation and issue tracker for all SysFlow projects. Quick reference Documentation : the SysFlow Documentation Where to get help : the SysFlow Community Slack Where to file issues : the github issue tracker Source of...

studio

ShipSec Studio Open-Source Security Workflow Orchestration Platform. ShipSec is currently in active development. We are optimizing the platform for stable production use and high-performance security operations. ShipSec Studio provides a visual DSL and runtime for building, executing, and...