AoratosWin

AoratosWin AoratosWin — это инструмент, который удаляет следы выполнения приложений в ОС Windows, легко выявляемые с помощью таких утилит, как ExecutedProgramList от Nirsoft. Не стесняйтесь декомпилировать, дизассемблировать, распространять и т.д. Поддерживаемые ОС протестировано Windows 7 x86, x...

Forensia

Forensia 레드 팀을 위한 안티 포렌식 도구로, 사후 침투 단계에서 일부 발자국을 지우는 데 사용됩니다. 페이로드 소진을 줄이고 탐지 카운트다운을 증가시킵니다. 사고 대응/포렌식 팀의 역량을 테스트하는 데 사용할 수 있습니다. 기능 Sysmon 드라이버 언로드 Gutmann 방법 파일 분쇄 USNJrnl 비활성화 Prefetch 비활성화 로그 지우개 및 이벤트 로그 비활성화 User Assist 업데이트 시간 비활성화 액세스 시간 비활성화 최근 항목 지우기 Shim 캐시 지우기 RecentFileCache 지우기...

MrKaplan

Mr.Kaplan Описание MrKaplan — это инструмент, предназначенный для помощи red team в сохранении скрытности путем удаления следов выполнения. Он работает, сохраняя такую информацию, как время запуска, снимки файлов и связывая каждое свидетельство с соответствующим пользователем. Этот инструмент...

ulexecve

빠른 시작 execve를 호출하지 않고 동적 또는 정적으로 컴파일된 ELF 리눅스 바이너리를 실행합니다. root@kitploit: cat /bin/echo | ulexecve - hello hello 소개 이 Python 도구는 ulexecve라고 하며 userland execve 를 의미합니다. 이 도구는 execve 시스템 콜을 호출하지 않고 리눅스 시스템의 사용자 공간에서 임의의 ELF 바이너리를 실행할 수 있게 해줍니다. 즉, 바이너리를 저장소에 쓰지 않고 메모리에서 직접 실행할 수 있습니다. 이는 안티 포렌식 또는...

freedomfighting

Скрипты для борьбы за свободу Этот репозиторий содержит скрипты, которые могут пригодиться в вашей деятельности по борьбе за свободу. Он будет обновляться время от времени, когда мне понадобится что-то, что я не могу найти в интернете. Всё здесь распространяется на условиях лицензии GPL v3...

Anti-Forensics

Anti-Forensics 안티-포렌식 기법을 추적하는 저장소 이 목록은 DFIR 커뮤니티의 응답과 현재 저희 Anti-Forensics 과정에서 다루는 기법을 기반으로 작성되었습니다. 공유하고 싶은 멋진 Anti-Forensic 아이디어가 있나요? DFIR DigitalForensics https://twitter.com/binaryz0ne/status/1618828773268520961 데이터, 웹 및 애플리케이션 관련 파일 형식 조작: -- PDF: 객체를 숨기기 위해 파일 구조 수정 -- ZIP: 다른 데이터/파일을...

MAL-2026-13879 Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

Malicious code in @oliviamcdaniel12/safer-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55129478b44191f3a4bb3308036567d5e2eb1a73084511b424917b6b5f7bf50f Package impersonates the popular safer-buffer module. On require, safer.js reads a PID from Porting-Buffer.md and, if that process is not alive, spaw...

Malicious code in analysis-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1ab4349bcc1e8f4434817d242b136f6e6050d4acb234aa833d81ffd74942066 The package's postinstall hook install-hook.js, invoked via package.json scripts.postinstall fetches an opaque binary 'payload.bin' from...

MAL-2026-6193 Malicious code in ordered-btree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a7b579313f4d78d1b99c88ed3fc22c295458981099a80f09f8408ca2bbb2ac4 Package impersonates the legitimate sorted-btree library matching name, README, and attributed author and ships a hidden remote-code-execution payloa...

HunterAgent: Neuro-Symbolic Attack Trace Reconstruction under Anti-Forensics

Modern alert-triage systems reduce SOC burden by filtering false positives, but flagging a high-risk alert is only the start of incident response. Threat hunting requires reconstructing causal attack chains across heterogeneous, partially corrupted logs. Against APTs using anti-forensics parent-P...

SoK: Understanding Anti-Forensics Concepts and Research Practices across Forensic Subdomains

Anti-forensics includes a growing set of techniques designed to obstruct forensic analysis. While cybercriminals increasingly rely on these methods, they also help researchers identify and remedy weaknesses in forensic tools, advancing the overall robustness of digital forensics. Despite repeated...

Cybercrime and Computer Forensics in Epoch of Artificial Intelligence in India

The integration of generative Artificial Intelligence into the digital ecosystem necessitates a critical re-evaluation of Indian criminal jurisprudence regarding computational forensics integrity. While algorithmic efficiency enhances evidence extraction, a research gap exists regarding the Digit...

Improving Cybercrime Detection and Digital Forensics Investigations with Artificial Intelligence

According to a recent EUROPOL report, cybercrime is still recurrent in Europe, and different activities and countermeasures must be taken to limit, prevent, detect, analyze, and fight it. Cybercrime must be prevented with specific measures, tools, and techniques, for example through automated...

penetration-testing-privilege-escalation-post-exploitation

Penetration Testing: Privilege Escalation & Post-Exploitation...

Forensia - Anti Forensics Tool For Red Teamers, Used For Erasing Footprints In The Post Exploitation Phase

AntiForensics Tool For Red Teamers, Used For Erasing Some Footprints In The Post Exploitation Phase. Reduces Payload Burnout And Increases Detection Countdown. Can Be Used To Test The capabilities of Your Incident Response / Forensics Teams. Capabilities Unloading Sysmon Driver. Gutmann Method Fi...

Pipka Card Skimmer Removes Itself After Infecting eCommerce Sites

A new JavaScript payment card skimmer, dubbed Pipka, has been identified on at least seventeen merchant websites attempting to target site visitors’ payment data. Unlike other skimmers, Pipka removes itself from the HTML code of compromised websites after exfiltrating payment card data – a...

Recent Cloud Atlas activity

Also known as Inception, Cloud Atlas is an actor that has a long history of cyber-espionage operations targeting industries and governmental entities. We first reported Cloud Atlas in 2014 and we've been following its activities ever since. From the beginning of 2019 until July, we have been able...

Sliver - Implant Framework

Sliver is a general purpose cross-platform implant framework that supports C2 over Mutual-TLS, HTTPS, and DNS. Implants are dynamically compiled with unique X.509 certificates signed by a per-instance certificate authority generated when you first run the binary. The server, client, and implant a...