EspressoCake

Defender_Exclusions-BOF. A BOF to determine Windows Defender exclusions.

Self_Deletion_BOF. BOF implementation of the research by @jonasLyk and the drafted PoC from @LloydLabs

DLL-Hijack-Search-Order-BOF. DLL Hijack Search Order Enumeration BOF

PPLDump_BOF. A faithful transposition of the key features/functionality of @itm4n's PPLDump project as a BOF.

Firewall_Walker_BOF. A BOF to interact with COM objects associated with the Windows software firewall.

HandleKatz_BOF. A BOF port of the research of @thefLinkk and @codewhitesec

DLL-Exports-Extraction-BOF. DLL Exports Extraction BOF with optional NTFS transactions.

BeaconDownloadSync.

DLL_Imports_BOF. A BOF to parse the imports of a provided PE-file, optionally extracting symbols on a per-dll basis.

Defender-Exclusions-Creator-BOF. C++

Toggle_Token_Privileges_BOF. Syscall BOF to arbitrarily add/detract process token privilege rights.

Process_Protection_Level_BOF. C

BOF_Development_Docker. A VSCode devcontainer for development of COFF files with batteries included.

BetterPipename. Example of using Sleep to create better named pipes.

BOF_NativeAPI_Definitions-VSCode. A VSCode plugin to assist with BOF development.

Cobalt_Strike_Ansible. A project to replicate the functionality of Noah Powers' ServerSetup script, but with error handling and fixed Namecheap API support.

ADIDNS_Parser. Parser and reconciliation tooling for large Active Directory environments.

Needle_Sift_BOF. Strstr with user-supplied needle and filename as a BOF.

DefenderPathExclusions. Creation and removal of Defender path exclusions and exceptions in C#.

ReadRemoteProcessCommandline_BOF. C

NativeFunctionStaticMap. A *very* imperfect attempt to correlate Kernel32 function calls to native API (Nt/Zw) counterparts/execution flow.

DynamicTabRename. CNA that interacts with a JAR file to dynamically rename GUI tabs within Cobalt Strike from a JSON file.

cIdentifyServiceDependencies_BOF. Beacon Object File (BOF) for identifying dependent child services of a given parent.

MITRE_ATTACK_CLI. CLI Search for Security Operators of MITRE ATT&CK URLs

DLL_Version_Enumeration_BOF. A BOF for enumerating version information for DLLs associated for a Beacon process.

Bloodhound_Community_Docker. Generator of docker-compose file to allow secure configurations and multi-deployment strategy.

EntropyFix. reducing the entropy of your payload

Aggressor_Scripts. A compilation of Aggressor/Sleep scripts for operational purposes that I've made.

RecreateCSDownloadsTree. Generation of TOML metadata for recreating directory structures from Cobalt Strike Beacon downloads.

PII_Generator. Fake PII Generator

nmapdb. A project built upon a loathing of XML.

ligolo-ng. An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

SCShell. Fileless lateral movement tool that relies on ChangeServiceConfigA to run command

ExampleCNARollup.

SharpHose. Asynchronous Password Spraying Tool in C# for Windows Environments

TitanLdr. Public variation of Titan Loader

gistfetch. Command-line utility to grab Github gists from your own account.

adidns_walker. Parse records of ADIDNS dumped data for valid A records with associated IP addresses

SituationalAwareness. Quick utilities for situational awareness of endpoints within Cobalt Strike's beacons with execute-assembly.