Educational collection of LLVM obfuscation passes. (Feel free to use it for your course)

KQL Queries. Microsoft Defender, Microsoft Sentinel

Resolve offsets, gadgets and symbols from NTKernel

A small toolkit for generating ClickOnce payloads with AppDomainManager Injection.

A tool leveraging Kerberos tickets to get Microsoft 365 access tokens using Seamless SSO

Advanced Windows authentication token extraction and decryption tool for red team operations and security research

AppLocker-Based EDR Neutralization

Anti-Rootkit/Anti-Cheat Driver to uncover unbacked or hidden kernel code.

PoC exploit for the vulnerable WatchDog Anti-Malware driver (amsdk.sys) – weaponized to kill protected EDR/AV processes via BYOVD.

Binary Exploitation Phrack CTF Challenge

Driver Reverse & Exploitation

x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration

Archive R/W into any protected process by changing the value of KTHREAD->PreviousMode

Proof of Concepts code for Bring Your Own Vulnerable Driver techniques

Two tools written in C that block network traffic for blacklisted EDR processes, using either Windows Defender Firewall (WDF) or Windows Filtering Platform (WFP).

Sanctum is an experimental proof-of-concept EDR, designed to detect modern malware techniques, above and beyond the capabilities of antivirus. Built in Rust.

A serie of exploits targeting eneio64.sys - Turning Physical Memory R/W into Virtual Memory R/W

Proof of Concepts code for Bring Your Own Vulnerable Driver techniques

Enumerate active EDR's on the system

BYOVD research use cases featuring vulnerable driver discovery and reverse engineering methodology. (CVE-2025-52915, CVE-2025-1055,).

Decrypt and Patch strings obfuscated with Appfuscator. Tested on Gremlin Stealer.

protector & obfuscator & code virtualizer

Run native PE or .NET executables entirely in-memory. Build the loader as an .exe or .dll—DllMain is Cobalt Strike UDRL-compatible

A user-mode code and its rootkit that will Kill EDR Processes permanently by leveraging the power of Process Creation Blocking Kernel Callback Routine registering and ZwTerminateProcess.

PoC for a Havoc agent/handler setup with all C2 traffic routed through GitHub. No direct connections: all commands and responses are relayed through Issues and Comments for maximum stealth.

Obfuscate the bytes of your payload with an association dictionary

ShadowPhish is an advanced APT awareness toolkit designed to simulate real-world phishing, malware delivery, deepfakes, smishing/vishing, and command & control attacks through an intuitive graphica…

POC of a better implementation of GetProcAddress for ntdll using binary search

DocPLZEx-Slack