Matt Hand

DefenderCheck. Identifies the bytes that Microsoft Defender flags on.

OffensiveCSharp. Collection of Offensive C# Tooling

Shhmon. Silencing Sysmon via driver unload

SHAPESHIFTER. Companion PoC for the "Adventures in Dynamic Evasion" blog post

spotter. Targeted Payload Execution

FindETWProviderImage. Quickly search for references to a GUID in DLLs, EXEs, and drivers

cpuid. A class to emulate the behavior of NtQuerySystemInformation when passed the SystemHypervisorDetailInformation information class

getDA.sh. Identify common attack paths to get Domain Administrator

misc. Collection of things I've written on pentests to make life easier.

penteensy. USB HID for Penetration Testing

StandIn. StandIn is a small .NET35/45 AD post-exploitation toolkit

SharpStay. .NET project for installing Persistence

unicorn. Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.

PowerSploit. PowerSploit - A PowerShell Post-Exploitation Framework

openedr. Open EDR public repository

Empire. Empire is a PowerShell and Python post-exploitation agent.

EyeWitness. EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

cpuid_for_antivm. A collection of cpuid instruction implementations for anti-vm purposes.

ferrisetw. Basically a KrabsETW rip-off written in Rust

wmi-rs. WMI crate for rust

malleable-c2. Cobalt Strike Malleable C2 Design and Reference Guide

SharpHound3. C# Data Collector for the BloodHound Project, Version 3

elam. A Practical example of ELAM (Early Launch Anti-Malware)

SharpHound. C#

EmPyre. A post-exploitation OS X/Linux agent written in Python 2.7

Mythic. A collaborative, multi-platform, red teaming framework

InternetCatFeeder. Raspberry Pi internet-enabled cat feeder using the PicoBorg Reverse

Seatbelt. Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.