Invoke-DumpMDEConfig

DumpMDEConfig PowerShell Script Overview Invoke-DumpMDEConfig is a PowerShell script designed to extract and display Microsoft Defender configuration and logs, including excluded paths, enabled ASR rules, allowed threats, protection history, and Exploit Guard protection history. The script provid...

KslDump

KslDump - BMVD Bring the Microsoft Vulnerable Driver Important context I reported the issue to Microsoft on 7 March 2026. However, almost 20 days earlier, the game-hacking community had already reversed and publicly discussed it. From my side, I do not follow their projects and I was not aware of...

CVE-2022-30190-follina

CVE-2022-30190-follina Just another PoC for the new MSDT-Exploit To edit the Doc, just open with 7z, xarchiver, ... to change the value in word\rels\document.xml.rels to your IP. The exploit must contain at least 3541 characters before the window.location.href, and they must be within the script...

BlueSAM

BlueSAM BOF A Cobalt Strike Beacon Object File adaptation of BlueHammer that attempts to obtain a copy of the SAM database through Windows Defender update/VSS behavior and process offline registry data from Beacon. Credits to Nightmare-Eclipse's BlueHammer...

KDStab

KDStab 6/28/2022 : Microsoft has rolled out a patch that prevents opening a handle to the MsMpEng.exe token, and as such the KillDefender portion of this tool no longer works. Backstab should still work. Not sure the patch ID, may work on older unpatched systems. Verified on Win10 21H2 and Win11...

Threat-Hunting

Threat-Hunting | Detection Engineering Collection of threat hunting and detection queries for: CrowdStrike Falcon using CQL – CrowdStrike Query Language Microsoft Defender XDR using KQL – Kusto Query Language Aimed at surfacing suspicious processes, anomalous network behaviors, living-off-the-lan...

CVE-2026-31321

PoC Defender is running Method 1 - Hide Windows Defender related folder Before Reboot After reboot, defender is gone Method 2 - Lock Windows Defender related folder After reboot Method...

onelinepy

onelinepy Python Obfuscator for FUD Python Code. Download & Run git clone https://github.com/spicesouls/onelinepy cd onelinepy chmod +x setup.sh ./setup.sh onelinepy Usage Guide | || | . | | -| | | | -| . | | |Python |||||||||| | |Obfuscator || || usage: oneline.py -h -m M -i I --script SCRIPT...

Azure-Sentinel

Microsoft Sentinel and Microsoft 365 Defender Welcome to the unified Microsoft Sentinel and Microsoft 365 Defender repository! This repository contains out of the box detections, exploration queries, hunting queries, workbooks, playbooks and much more to help you get ramped up with Microsoft...

Vulnerability-scanner

With the increasing reliance of organizations on digital technologies to carry out communication, data storage, and business operations, the threats to cybersecurity have significantly increased. Given the critical role that endpoint security software plays in securing networks and systems, such...

MultiDump

MultiDump MultiDump is a post-exploitation tool written in C for dumping and extracting LSASS memory discreetly, without triggering Defender alerts, with a handler written in Python. Blog post: https://xreous.io/posts/multidump MultiDump supports LSASS dump via ProcDump.exe or comsvc.dll, it offe...

nim-shell

Nim-Shell Reverse shell that can bypass EDR and windows defender detection Please do not upload to VirusTotal 𝗜𝗡𝗦𝗧𝗔𝗟𝗟𝗔𝗧𝗜𝗢𝗡 𝗜𝗡𝗦𝗧𝗥𝗨𝗖𝗧𝗜𝗢𝗡𝗦 $ apt install nim Compilation nim c -d:mingw --app:gui nimshell.nim Change the IP address and port number you want to listen to in the nimshell.nim file accordin...

gundog

gundog gundog - PowerShell based guided hunting in Microsoft 365 Defender Gundog provides you with guided hunting in Microsoft 365 Defender. Especially if not only for Email and Endpoint Alerts at the moment. Functionality You provide an AlertID you might received via Email notification and gundo...

PPLBlade

PPLBlade Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk. Key functionalities : 1. Bypassing PPL protection 2. Obfuscating memory dump files to evade Defender signature-based detection mechanisms 3...

DNS_Tunneling

Intro Inspired by recent work I did involving Cobalt Strike DNS beacons, in conjunction with a mission statement to try and evade Microsoft Defender for Endpoint, I spent some time looking into how DNS might be used to transfer a payload to a target machine. I further wanted to challenge myself b...

WDExtract

WDExtract Extract Windows Defender database from vdm files and unpack it This program is distributed as-is, without any warranty; No official support, if you like this tool, feel free to contribute. Features Unpack VDM containers of Windows Defender/Microsoft Security Essentials; Decrypt VDM...

msticpy

MSTIC Jupyter and Python Security Tools Microsoft Threat Intelligence Python Security Tools. msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources enrich the data with Threat Intelligence, geolocations a...

KQL-threat-hunting-queries

Threat hunting/detecting using KQL queries | |/ / | | | | | | | | | / | | | | | | | | | \ | | | | \ | |/ | | ' | | | | | | | | || | | | | / \ | | | || | | | | | | | | | || | | | | . | || | | | | | | !NOTE Jan. 27th: After almost a year of contributions, this repository is undergoing a heavy...

azure-sentinel-detection-engineering

Azure Sentinel Detection Engineering Detection engineering on a live Microsoft Sentinel and Defender XDR environment I operate. Nine custom analytics rules span three planes, each mapped to MITRE ATT&CK and proven end to end: a controlled action triggers the rule, the rule raises an incident, and...

FUD-UUID-Shellcode

FUD-UUID-Shellcode Introduction Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness :. How it works Shellcode generation Firstly, generate a payload in binary format using either Havoc, CobaltStrike or...