realoriginal
/ CtlInject_Legacy.c
Created
October 26, 2023 15:41
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /*! | |
| * | |
| * ROGUE | |
| * | |
| * GuidePoint Security LLC | |
| * | |
| * Threat and Attack Simulation Team | |
| * | |
| !*/ |
Samirbous
/ evasion_reg_values
Created
June 15, 2023 19:54
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| "Top 10000 values of registry.value","Count of records" | |
| TamperProtection,"1,400" | |
| DisableAntiSpyware,"1,388" | |
| DisableBehaviorMonitoring,"1,381" | |
| DisableIOAVProtection,"1,368" | |
| DisableOnAccessProtection,"1,359" | |
| DisableRealtimeMonitoring,"1,344" | |
| DisableScanOnRealtimeEnable,"1,323" | |
| DisableNotifications,"1,312" | |
| AUOptions,"1,280" |
jsecurity101
/ KerberosCorrelation.ipynb
Last active
May 28, 2024 22:40
Kerberos Detection/Investigation
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
tothi
/ minimal-defender-bypass.profile
Last active
July 13, 2024 09:12
Minimal Cobalt Strike C2 Profile for Bypassing Defender
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # in addition to the profile, a stage0 loader is also required (default generated payloads are caught by signatures) | |
| # as stage0, remote injecting a thread into a suspended process works | |
| set host_stage "false"; | |
| set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Edg/96.0.1054.62"; | |
| set sleeptime "10000"; | |
| stage { | |
| set allocator "MapViewOfFile"; | |
| set name "notevil.dll"; |
