Two Seven One Three

EDR-Freeze. EDR-Freeze is a tool that puts a process of EDR, AntiMalware into a coma state.

WSASS. This is the tool to dump the LSASS process on modern Windows 11

CreateProcessAsPPL. This is the loader that supports running a program with Protected Process Light (PPL) protection functionality.

EDRChoker. A tool uses the QoS Policy (Pacer.sys) to throttle Endpoint Detection and Response (EDR) agents from connecting to the server.

EDR-Redir. EDR-Redir : a tool used to redirect the EDR's folder to another location.

EDRStartupHinder. EDRStartupHinder: A red team tool to prevent Antivirus and EDR from running.

IAmAntimalware. This tool helps inject code into the processes of Antivirus programs.

DefenderWrite. A tool that supports finding and abusing whitelisted programs to allow arbitrary file writing into the executable folder of Antivirus software

CertClone. The tool used to clone the digital signatures of legitimate programs

Windows-Defender-Manager. Windows Defender Manager is a tool that helps stop Windows Defender. It works with the Antimalware Service Executable of all versions of Windows 10 and Windows 11.

RecoverIt. A tool that helps change the recovery configuration of a Windows service to make lateral movement more stealthy

Kaburra. Kaburra is a project that supports demo attack phase in Social Engineering Awareness training.

CVE-2026-41096-Attack-Surface. Attack surface in the real-world environment of CVE-2026-41096

Windows-OPSEC-Training. Operation security (OPSEC), invaluable resources for Windows. Actionable recommendations for those looking to enhance their privacy and security online.

SparringRAT. A simple tool simulating the operation of a RAT used in phishing. Customized to be executable with different scenarios.

100-CPU. "100 CPU" is a simple and user-friendly open-source tool that supports troubleshooting high CPU usage. It helps you identify the root cause of high CPU consumption issues.

demo-codes. This is the repository for storing the demonstration code.

TwoSevenOneThree. Config files for my GitHub profile.

zerosalarium.