1727 matches found
EventHorizon
EventHorizon EventHorizon is a tool meant to arm security analysts and/or researchers with Event Tracing for Windows ETW telemetry that, coupled with sigma-like rules, allow for robust endpoint detection and response capabilities. That being said, EventHorizon is in no way a replacement for prope...
TokenUniverse
Token Universe Token Universe es una herramienta avanzada para experimentar e investigar los mecanismos de seguridad de Windows. Expone una interfaz de usuario para crear, visualizar, suplantar y modificar tokens de acceso, generar procesos, gestionar la Autoridad de Seguridad Local, verificar el...
ludus-defender-lab
Ludus Defender Lab Ludus range config and Ansible roles for a Windows security lab pre-staged for MDE and MDI, with a fully misconfigured ADCS installation for detection coverage testing. Config| VMs| Purpose ---|---|--- zsec-mde-mdi-lab.yml| DC01 + WKS01| MDE/MDI detection lab with ADCS ESC1–ESC...
concealed_position
Concealed Position Concealed Position is a local privilege escalation attack against Windows using the concept of "Bring Your Own Vulnerability". Specifically, Concealed Position CP uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install...
commando-vm
¿Qué es CommandoVM? Complete Mandiant Offensive VM "CommandoVM" es una distribución de seguridad integral y personalizable basada en Windows para pruebas de penetración y red teaming. CommandoVM incluye una variedad de herramientas ofensivas no incluidas en Kali Linux que destacan la eficacia de...
sysmon-config
sysmon-config | Un archivo de configuración de Sysmon para que todos lo bifurquen Esta es una plantilla de archivo de configuración de Sysmon de Microsoft Sysinternals con un seguimiento de eventos predeterminado de alta calidad. El archivo debería funcionar como un excelente punto de partida par...
PrivescCheck
PrivescCheck Quickly identify common Windows vulnerabilities and configuration issues that are not necessarily covered by public security standards, and collect useful information for exploitation and post-exploitation tasks. !IMPORTANT A major aspect to be aware of when using this tool is that a...
WSASS
WSASS This is a tool that uses the old WerfaultSecure.exe program to dump the memory of processes protected by PPL Protected Process Light, such as LSASS.EXE. The output is in Windows MINIDUMP format. This tool automatically replaces the"MDMP" magic header with a PNG magic header. After the dump ...
ctftool
CTFTOOL Just want to test the SYSTEM exploit? Click here. An Interactive CTF Exploration Tool This is ctftool, an interactive command line tool to experiment with CTF, a little-known protocol used on Windows to implement Text Services. This might be useful for studying Windows internals, debuggin...
CredsLeaker
CredsLeaker v4.x Un agradecimiento especial a @ApSecDev que llevó este proyecto al siguiente nivel! ¡Felicitaciones! Este script solía mostrar un cuadro de credenciales de PowerShell que pedía credenciales al usuario. Sin embargo, eso era muy notorio. ¡Ahora es momento de utilizar la ventana...
attack_monitor
Monitor de Ataques Attack Monitor es una aplicación Python escrita para mejorar las capacidades de monitoreo de seguridad de estaciones de trabajo/servidores de Windows 7/2008 y todas las versiones posteriores y para automatizar el análisis dinámico de malware. Modos actuales mutuamente...
TelemetrySource
TelemetrySource Project created to map functions repsonsible for triggering events from various telemetry sources. Main Mapping Sheet: Event Mapping Google Sheet Currently mapped sources: Sysmon Window Security Events Microsoft-Windows-Security-Auditing Threat Intelligence Events...
DarthSidious
Darth Sidious El objetivo es simple Compartir mi modesto conocimiento sobre la piratería de sistemas Windows. Esto se conoce comúnmente como ejercicios de red team. Sin embargo, este libro también se preocupa mucho por el equipo azul; los defensores. Es decir, ayudar a quienes trabajan como...
OWN-Defender
OWN-Defender — Windows Security Center COM Research OWN-Defender is a Windows security research project focused on understanding how Windows Security Center WSC represents and manages antivirus security products through its COM interfaces. The project began as an investigation into the behavior...
mora-hwbp
Mora-HWBP — AMSI / WLDP / ETW Telemetry Hooking via Hardware Breakpoints A security-research Proof-of-Concept POC demonstrating hardware-breakpoint CPU debug register based function hooking as an alternative to traditional in-memory code patching. Purpose & Scope This repository is published...
CVE-2026-77899
Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally...
EUVD-2026-73810
Use after free in Windows Security Health Service allows an authorized attacker to elevate privileges locally...
EUVD-2026-73291
Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally...
CVE-2026-77899
CVE-2026-77899 is a use-after-free vulnerability in Windows Security Center that allows an authorized attacker to escalate privileges locally . The CVSS v3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting the need for low privileges and high attack complexity...
