LZ

ExtractedDefender. Collection of extracted Microsoft Defender data for security research purposes

gibson. Network monitoring tool that maps process-to-network connections, identifies cloud providers, and detects beaconing activity. Zero-flag agent binary for deployment, aggregation server, offline ASN lookup.

IndicatorOfCanary. Canary Detection

defender_overview. Overview of MS Defender

maps_scanner. MAPS cloud scanner and response parser for Microsoft Defender research.

svg_phishing_tools. SVG Analysis and generation tools for commonly seen SVG attachment phishing

litellm_1.82.8_payload. Defanged malware stages from the litellm 1.82.8 PyPI supply chain compromise — credential stealer, K8s lateral movement, C2 backdoor

saas_enum. Command-line tool for discovering SaaS platforms a company uses via DNS enumeration

TomcatBackdoorPoC. Tomcat backdoor based on CS blog

ja4_proxy. JA4 proxy tooling.

PhantomPhreak. USB Modem/IAX2 War Dialer

CVE-2025-27237. CVE 2025 27237 Zabbix LPE proof of concept.

loadlibrary-patch-kit. VDM sig bypass and additional WinAPI stubs

telnyx_4.87.1_payload. Defanged malware stages from the telnyx 4.87.1/4.87.2 PyPI supply chain compromise — WAV steganography, credential stealer, Windows persistence

AgentProvocateur. For testing or trolling LLM based pentesting frameworks.

tradecraft-training. Interactive slide deck covering operational security principles for authorized red team operations and penetration testing

fingerprint_js. Browser fingerprinting and automation/bot detection analyzer — VexTrio a-series + extended b-series checks

push_matrix_tool. Push notification demo based on malware seen in the wild.

psdecode. Compiled .NET 8 PowerShell deobfuscation sandbox — hosts the PS engine to intercept malware execution

panrapidcheck. Extract useful information from PANOS support file for CVE-2024-3400

ip-obfuscation. IP obfuscation and URL generator.

holley-efi-parser. Holley EFI utilities.

NimPlant. A light-weight first-stage C2 implant written in Nim.