.github

0xpat.github.io

0xpat blog

aad-sso-enum-brute-spray

POC of SecureWorks' recent Azure Active Directory password brute-forcing vuln

aced

aceldr

Cobalt Strike UDRL for memory scanner evasion.

adcollector

A lightweight tool to quickly extract valuable information from the Active Directory environment for both attacking and defending.

addreferencedotredteam

A PoC to show how to add code to C# and dotNet and make it reusable for Red Team operations. Maybe one day it will be the largest collection of C# red team projects in 1 Lib.

aggressiveproxy

Project to enumerate proxy configurations and generate shellcode from CobaltStrike

aggressor-scripts

Aggressor scripts for Cobalt Strike

aggressor-vysec

aggressor_snippets

A collection of random small Aggressor snippets that don't warrant their own repo

alaris

A protective and Low Level Shellcode Loader that defeats modern EDR systems.

alternativeshellcodeexec

Alternative Shellcode Execution Via Callbacks

amsi-etw-patch

Patch AMSI and ETW

amsi.fail

C# Azure Function with an HTTP trigger that generates obfuscated PowerShell snippets that break or disable AMSI for the current process.

amsiscanbufferbypass

Circumvent AMSI by patching AmsiScanBuffer

amsiscanner

amsitrigger

The Hunt for Malicious Strings

andrewspecial

AndrewSpecial, dumping lsass' memory stealthily and bypassing "Cilence" since 2019.

asrenum-bof

Cobalt Strike BOF that identifies Attack Surface Reduction (ASR) rules, actions, and exclusion locations

autodirbuster

Automatically run and save Dirbuster scans for multiple IPs

autoupdatesysmonexe

avcleaner

C/C++ source obfuscator for antivirus bypass

awesome-password-cracking

A curated list of awesome tools, research, papers and other projects related to password cracking and password security.

azredteamenumscript

Azure AD RedTeam Full Enumeration Script used to query all aspects of your target Azure tenant.

azureadjoinedmachineptc

azurec2relay

AzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile.

azurehound

azureoutlookc2

Azure Outlook Command & Control (C2) - Remotely control a compromised Windows Device from your Outlook mailbox. Threat Emulation Tool for North Korean APT InkySquid / ScarCruft / APT37. TTP: Use Microsoft Graph API for C2 Operations.

azurewebsitecs-setup

Python script for automating the creation of serverless cloud redirectors from Cobalt Strike malleable C2 profiles