process_overwriting

Process Overwriting Process Overwriting is a PE injection technique, closely related to Process Hollowing and Module Overloading. With its help, you can replace the main executable not a DLL of the target process. It works only for a newly created process - injection to existing processes is not...

bandwhich

bandwhich This is a CLI utility for displaying current network utilization by process, connection and remote IP/hostname Table of contents bandwhich Table of contents Project status How does it work? Installation Downstream packaging status Download a prebuilt binary Building from source...

BeaconEye

BeaconEye Introduction BeaconEye scans running processes for active CobaltStrike beacons. When processes are found to be running beacon, BeaconEye will monitor each process for C2 activity. How it works BeaconEye will scan live processes or MiniDump files for suspected CobaltStrike beacons. In li...

pyradm

🔮 pyradm Remote administration crossplatfrom tool via telegram Coded with ❤️ python3 + aiogram3 https://t.me/whlab Screenshots Disclaimer All information contained in this repository is provided for educational and research purposes only The author is not responsible for any illegal use of this...

arp-validator

arp-validator Security Tool to detect arp poisoning attacks Features Uses a faster approach in detection of arp poisoning attacks compared to passive approaches Detects not only presence of ARP Poisoning but also valid IP-MAC mapping when LAN hosts are using non-customized network stack Stores...

netwatch

NetWatch Network diagnostics in your terminal. netwatch --view dense. Four boxes, no chrome, every keybind on a border. Download grows up from the axis, upload grows down. One binary, no config. sudo netwatch and you have live capture with L7 decode, process attribution where available, and a...

bpflock

bpflock - Lock Linux machines bpflock - eBPF driven security for locking and auditing Linux machines. Note: bpflock is currently in experimental stage , it may break, options and security semantics may change, some BPF programs will be updated to use Cilium ebpf library. Sections 1. Introduction...

PELoader

PELoader PELoader implement various shellcode injection techniques, and use libpeconv library to load encrypted PE files instead of injecting shellcode into remote thread. Following techniques were implemented: Module Stomping LoadLibrary Module Stomping NtMapViewOfSection PoC Transacted Hollowin...

SharpEDRChecker

SharpEDRChecker New and improved C Implementation of Invoke-EDRChecker. Checks running processes, process metadata, Dlls loaded into your current process and each DLLs metadata, common install directories, installed services and each service binaries metadata, installed drivers and each drivers...

SharpImpersonation

SharpImpersonation This was a learning by doing project from my side. Well known techniques are used to built just another impersonation tool with some improvements in comparison to other public tools. The code base was taken from: https://github.com/0xbadjuju/Tokenvator A blog post for the...

EDRHunt

EDRHunt EDRHunt scans Windows services, drivers, processes, registry, wmi for installed EDRs Endpoint Detection And Response. Read more about EDRHunt here. Install Binary Download the latest release from the release section. Releases are built for windows/amd64. Go Requires Go to be installed on...

elevationstation

Elevation Station Stealing and Duplicating SYSTEM tokens for fun & profit! We duplicate things, make twin copies, and then ride away. You have used Metasploit's getsystem and SysInternals PSEXEC for getting system privs, correct? Well, here's a similar standalone version of that...but without the...

ZombifyProcess

ZombifyProcess http://www.malwaretech.com/2014/12/zombie-processes-as-hips-bypass.html Yes, I use do whilefalse, please don't hate me...

timesketch

Timesketch Table of Contents 1. About Timesketch 2. Getting started 3. Community 4. Contributing About Timesketch Timesketch is an open-source tool for collaborative forensic timeline analysis. Using sketches you and your collaborators can easily organize your timelines and analyze them all at th...

hollows_hunter

hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...

santa

Santa !NOTE As of 2025, Santa is no longer maintained by Google. We encourage existing users to migrate to an actively maintained fork of Santa, such as https://github.com/northpolesec/santa. Santa is a binary and file access authorization system for macOS. It consists of a system extension that...

psc

psc psc ps container is a fast process scanner that uses eBPF iterators and Google CEL to query system state with precision and full container context. Why psc? Fast Kernel-Level Access with eBPF Iterators psc uses eBPF iterators to read process and file descriptor information directly from kerne...

watcher

Anti Reverse Shell Hello my name is themoon also known shalev, i created this project to help people who run servers with lower security. You can use this project to protect your computer from attackers who may try to reverse shell your computer Informations on this project You can view how this...

thc-tips-tricks-hacks-cheat-sheet

THC's favourite Tips, Tricks & Hacks Cheat Sheet https://thc.org/tips A collection of our favourite tricks. Many of those tricks are not from us. We merely collect them. We show the tricks 'as is' without any explanation why they work. You need to know Linux to understand how and why they work. G...

PyStat

PyStat - Advanced Netstat For Windows Compatible with Python Version 2.7 Features Know remote address of process Know remote ports of process Know which user using process along with title & PID Changelogs: Auto Install python modules support added in install.py Installation Guide: Download the...