Windows Event logs are the main source of information for defensive security teams to identify threats and for administrators to troubleshoot errors. The logs are represented in a structured format (X...

The HAFNIUM threat actor is using an unconventional method to tamper scheduled tasks in order to establish persistence via modification of registry keys in their malware called Tarrask. The benefit of...

Microsoft search protocol enables clients to initiate connections against an enterprise search service such as SharePoint or WebDav. During these search connections the protocol server will respond wi...

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server. - GitHub - netero1010/EDRSilencer: A tool uses Windo...

Contribute to lap1nou/CLR_Heap_encryption development by creating an account on GitHub.

Reflective x64 loader implemented using dynamic indirect syscalls - GitHub - Krypteria/AtlasLdr: Reflective x64 loader implemented using dynamic indirect syscalls

A beacon object file implementation of PoolParty Process Injection Technique. - GitHub - 0xEr3bus/PoolPartyBof: A beacon object file implementation of PoolParty Process Injection Technique.

A set of fully-undetectable process injection techniques abusing Windows Thread Pools - GitHub - SafeBreach-Labs/PoolParty: A set of fully-undetectable process injection techniques abusing Windows ...

Contribute to nettitude/Tartarus-TpAllocInject development by creating an account on GitHub.