1786 matches found
PrivescCheck
PrivescCheck Quickly identify common Windows vulnerabilities and configuration issues that are not necessarily covered by public security standards, and collect useful information for exploitation and post-exploitation tasks. !IMPORTANT A major aspect to be aware of when using this tool is that a...
sysmon-config
sysmon-config | A Sysmon configuration file for everybody to fork This is a Microsoft Sysinternals Sysmon configuration file template with default high-quality event tracing. The file should function as a great starting point for system change monitoring in a self-contained and accessible package...
ctftool
CTFTOOL Just want to test the SYSTEM exploit? Click here. An Interactive CTF Exploration Tool This is ctftool, an interactive command line tool to experiment with CTF, a little-known protocol used on Windows to implement Text Services. This might be useful for studying Windows internals, debuggin...
CredsLeaker
CredsLeaker v4.x A big shoutout to @ApSecDev who took this project to the next level! Kudos! This script used to display a powershell credentials box asked the user for credentials. However, That was highly noticeable. Now it's time to utilize Windows Security popup! Features AD domain...
WSASS
WSASS This is a tool that uses the old WerfaultSecure.exe program to dump the memory of processes protected by PPL Protected Process Light, such as LSASS.EXE. The output is in Windows MINIDUMP format. This tool automatically replaces the"MDMP" magic header with a PNG magic header. After the dump ...
TokenUniverse
Token Universe Token Universe is an advanced tool for experimenting and researching Windows security mechanisms. It exposes UI for creating, viewing, impersonating, and modifying access tokens, spawning processes, managing Local Security Authority, checking available access and modifying security...
commando-vm
What is CommandoVM? Complete Mandiant Offensive VM "CommandoVM" is a comprehensive and customizable, Windows-based security distribution for penetration testing and red teaming. CommandoVM comes packaged with a variety of offensive tools not included in Kali Linux which highlight the effectivenes...
concealed_position
Concealed Position Concealed Position is a local privilege escalation attack against Windows using the concept of "Bring Your Own Vulnerability". Specifically, Concealed Position CP uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install...
TelemetrySource
TelemetrySource Project created to map functions repsonsible for triggering events from various telemetry sources. Main Mapping Sheet: Event Mapping Google Sheet Currently mapped sources: Sysmon Window Security Events Microsoft-Windows-Security-Auditing Threat Intelligence Events...
OWN-Defender
OWN-Defender — Windows Security Center COM Research OWN-Defender is a Windows security research project focused on understanding how Windows Security Center WSC represents and manages antivirus security products through its COM interfaces. The project began as an investigation into the behavior...
mora-hwbp
Mora-HWBP — AMSI / WLDP / ETW Telemetry Hooking via Hardware Breakpoints A security-research Proof-of-Concept POC demonstrating hardware-breakpoint CPU debug register based function hooking as an alternative to traditional in-memory code patching. Purpose & Scope This repository is published...
ludus-defender-lab
Ludus Defender Lab Ludus range config and Ansible roles for a Windows security lab pre-staged for MDE and MDI, with a fully misconfigured ADCS installation for detection coverage testing. Config| VMs| Purpose ---|---|--- zsec-mde-mdi-lab.yml| DC01 + WKS01| MDE/MDI detection lab with ADCS ESC1–ESC...
CVE-2026-122474
Time-of-check time-of-use toctou race condition in Windows Security Account Manager allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-113842
Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally...
CVE-2026-112966
Uncontrolled resource consumption in Windows Security Account Manager allows an unauthorized attacker to deny service over a network...
CVE-2026-112795
Untrusted pointer dereference in Windows Security Account Manager allows an authorized attacker to deny service over a network...
CVE-2026-122474
A Time-of-check time-of-use (TOCTOU) race condition exists in the Windows Security Account Manager , which could allow an unauthorized attacker to bypass a security feature over a network. This vulnerability impacts integrity and is assigned CWE-367 . While specific exploit details are not provid...
EUVD-2026-122505
Time-of-check time-of-use toctou race condition in Windows Security Account Manager allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-113842
A use after free vulnerability exists in the Windows Security Center , which could allow an authorized attacker to elevate privileges locally . While the technical root cause and specific affected components are not detailed in the provided documents, the vulnerability is confirmed with a High se...