TelemetrySourcerer

Telemetry Sourcerer Introduction Telemetry Sourcerer can enumerate and disable common sources of telemetry used by AV/EDR on Windows. Red teamers and security enthusiasts can use this tool in a lab environment to: Identify collection-based blind spots in the products they're up against. Determine...

EDRSandblast

EDRSandBlast EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections Notify Routine callbacks, Object Callbacks and ETW TI provider and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring. As of...

Interceptor

Interceptor Autor: @Cerbersec Interceptor es un driver de kernel centrado en alterar soluciones EDR/AV en espacio de kernel mediante el parcheo de callbacks del kernel y el enganchado hooking de IRPs. Interceptor fue creado como parte de unas prácticas en el Red Team de NVISO Security. Las...

PE-Obfuscator

PE-Obfuscator Ofuscador de PE pensado para la evasión , necesita Privilegios de administrador para cargar el controlador RTCore64. Vídeo: https://user-images.githubusercontent.com/123980007/234171901-c1eb735e-ceca-481d-9310-02ba30f6836b.mp4 El Ofuscador : - Obtiene el PE fileless xoreado de un...

EDRSandblast-GodFault

EDRSandblast-GodFault By Gabriel Landau at Elastic Security. Modification of EDRSandblast - see original README below. Integrates GodFault into EDR Sandblast, achieving the same result without the use of any vulnerable drivers. Example Output C:\Users\user\Desktop\OffsetsEDRSandblast.exe...

PT-2026-56209

MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator...

EDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections

EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections Kernel callbacks and ETW TI provider and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring. As of release, combination of userland...

DarkLoadLibrary - LoadLibrary For Offensive Operations

LoadLibrary for offensive operations. How does is work? https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks/ Usage DARKMODULE DarkModule = DarkLoadLibrary LOADLOCALFILE, // control flags L"TestDLL.dll", // local dll path, if loading from disk NULL, // DLL Buffer to load from if...