simplest & fastest way to transfer files between computers via WireGuard

Quine • a streaming graph • https://quine.io • Discord: https://discord.gg/GMhd8TE4MR

Kooky cURL-powered replacement for reverse shell via /dev/tcp

Fileless atexec, no more need for port 445

A modular and blazing fast runtime security tool for the IoT, powered by eBPF.

"Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting" by Erik Hemberg, Jonathan Kelly, Michal Shlapent…

Visualizing data in ClickHouse using native Kibana.

Kubernetes集群管理平台，CMDB，K8S容器管理，运维平台，自动化运维发布平台，CICD平台，多集群管理

Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...

ebpf WebShell/内核马，一种新型内核马/WebShell技术

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

A C# port from Invoke-GhostTask

Detect WFP filters blocking EDR communications

nginx WebShell/内存马，更优雅的nignx backdoor

CIA UAC bypass implementation of Stinger that obtains the token from an auto-elevated process, modifies it, and reuses it to execute as Administrator.

Patching "signtool.exe" to accept expired certificates for code-signing.

Little AV/EDR bypassing lab for training & learning purposes

Codes and data for USENIX Security 24 paper "MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning"

A beacon object file implementation of PoolParty Process Injection Technique.

nysm is a stealth post-exploitation container.

Threat-hunting tool for Linux

A set of fully-undetectable process injection techniques abusing Windows Thread Pools

Detect and remove the presence of canary tokens

Learn eBPF by examples | eBPF 开发者教程与知识库：通过小工具和示例一步步学习 eBPF，包含性能、网络、安全等多种应用场景

An Adaptive Misuse Detection System

Network security testing for Kubernetes DevSecOps workflows

secgpt网络安全大模型

A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!

A New Exploitation Technique for Visual Studio Projects