-
-
Notifications
You must be signed in to change notification settings - Fork 64
Collapse file tree
Files
/
Copy pathGUIDproject_tag_detection.csv
1035 lines (1035 loc) · 505 KB
/
GUIDproject_tag_detection.csv
1 | keyword | metadata_keyword_regex | metadata_keyword_type | metadata_tool | metadata_description | metadata_tool_techniques | metadata_tool_tactics | metadata_malwares_name | metadata_groups_name | metadata_category | metadata_link | metadata_enable_endpoint_detection | metadata_enable_proxy_detection | metadata_tags | metadata_comment | metadata_severity_score | metadata_popularity_score | metadata_github_stars | metadata_github_forks | metadata_github_updated_at | metadata_github_created_at | metadata_entry_id |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2 | *00630066-0B43-474E-A93B-417CF1A65195* | .{0,1000}00630066\-0B43\-474E\-A93B\-417CF1A65195.{0,1000} | offensive_tool_keyword | impersonate | A windows token impersonation tool | T1134 - T1550 | TA0004 - TA0003 | N/A | N/A | Lateral Movement | https://github.com/sensepost/impersonate | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 301 | 38 | 2023-04-19T12:53:50Z | 2022-10-28T06:30:02Z | 20660 |
3 | *00B41CF0-7AE9-4542-9970-77B312412535* | .{0,1000}00B41CF0\-7AE9\-4542\-9970\-77B312412535.{0,1000} | greyware_tool_keyword | SoftEtherVPN | Cross-platform multi-protocol VPN software abused by attackers | T1133 - T1210 - T1573 - T1219 - T1571 | TA0001 - TA0002 - TA0003 - TA0005 - TA0010 | N/A | GALLIUM | Defense Evasion | https://github.com/SoftEtherVPN/SoftEtherVPN | 1 | 0 | #GUIDproject #VPN | N/A | 8 | 10 | 12183 | 2647 | 2025-04-13T22:05:51Z | 2014-01-02T12:40:57Z | 20683 |
4 | *00D7268A-92A9-4CD4-ADDF-175E9BF16AE0* | .{0,1000}00D7268A\-92A9\-4CD4\-ADDF\-175E9BF16AE0.{0,1000} | offensive_tool_keyword | r77-rootkit | Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections | T1014 - T1055 - T1055.013 - T1060 - T1106 - T1070.009 | TA0005 - TA0003 | N/A | N/A | Persistence | https://github.com/bytecode77/r77-rootkit | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1884 | 425 | 2025-03-25T17:59:20Z | 2017-12-17T13:04:14Z | 20696 |
5 | *015A37FC-53D0-499B-BFFE-AB88C5086040* | .{0,1000}015A37FC\-53D0\-499B\-BFFE\-AB88C5086040.{0,1000} | offensive_tool_keyword | DecryptAutoLogon | Command line tool to extract/decrypt the password that was stored in the LSA by SysInternals AutoLogon | T1003.001 - T1555.003 - T1003.006 | TA0006 | N/A | N/A | Credential Access | https://github.com/securesean/DecryptAutoLogon | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 218 | 32 | 2020-12-05T16:14:28Z | 2020-12-03T20:38:59Z | 20722 |
6 | *01871B2B-B006-4069-997D-BAB3EB216160* | .{0,1000}01871B2B\-B006\-4069\-997D\-BAB3EB216160.{0,1000} | offensive_tool_keyword | Carbanak | remote backdoor used by a group of the same name (Carbanak). It is intended for espionage - data exfiltration and providing remote access to infected machines | T1021.002 - T1071.001 - T1105 - T1059 - T1003 - T1078 - T1041 | TA0006 - TA0008 - TA0010 - TA0011 | Carbanak | FIN7 - Carbanak | Malware | https://github.com/0x25bit/Updated-Carbanak-Source-with-Plugins | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 396 | 223 | 2019-05-01T23:31:35Z | 2019-04-22T21:01:08Z | 20737 |
7 | *018BD6D4-9019-42FD-8D3A-831B23B47CB2* | .{0,1000}018BD6D4\-9019\-42FD\-8D3A\-831B23B47CB2.{0,1000} | offensive_tool_keyword | ROADtoken | Abusing Azure AD SSO with the Primary Refresh Token - ROADtoken is a tool that uses the BrowserCore.exe binary to obtain a cookie that can be used with SSO and Azure AD | T1557 - T1078 - T1071.001 - T1552.001 | TA0006 | N/A | N/A | Credential Access | https://github.com/dirkjanm/ROADtoken | 1 | 0 | #GUIDproject | N/A | 7 | 1 | 89 | 17 | 2020-09-30T16:18:47Z | 2020-07-21T12:42:14Z | 20740 |
8 | *01C142BA-7AF1-48D6-B185-81147A2F7DB7* | .{0,1000}01C142BA\-7AF1\-48D6\-B185\-81147A2F7DB7.{0,1000} | offensive_tool_keyword | StandIn | StandIn is a small .NET35/45 AD post-exploitation toolkit | T1087 - T1069 - T1558 - T1204 - T1136 - T1482 | TA0007 - TA0003 - TA0006 - TA0004 | N/A | N/A | Discovery | https://github.com/FuzzySecurity/StandIn | 1 | 0 | #GUIDproject | N/A | 9 | 8 | 761 | 129 | 2023-12-02T21:20:09Z | 2020-11-05T22:49:27Z | 20754 |
9 | *0228336A-2F4C-0D17-2E11-86654A1FAD8D* | .{0,1000}0228336A\-2F4C\-0D17\-2E11\-86654A1FAD8D.{0,1000} | offensive_tool_keyword | gh0st | Malware RAT with keylogger - dll injection - C2 - Remote control | T1204.002 - T1071.001 - T1027 - T1036.005 - T1055.001 - T1005 - T1056.001 - T1074.001 - T1105 - T1562.001 - T1543.003 - T1547.001 - T1571 - T1573.001 - T1106 - T1219 | TA0002 - TA0003 - TA0004 - TA0008 - TA0009 - TA0010 - TA0011 | GhostRAT | N/A | Malware | https://github.com/sin5678/gh0st | 1 | 0 | #GUIDProject | N/A | 10 | 6 | 508 | 274 | 2013-05-08T21:17:26Z | 2012-10-05T06:25:36Z | 20783 |
10 | *022E5A85-D732-4C5D-8CAD-A367139068D8* | .{0,1000}022E5A85\-D732\-4C5D\-8CAD\-A367139068D8.{0,1000} | offensive_tool_keyword | Krueger | remotely killing EDR with WDAC | T1562.001 - T1562.004 - T1218.011 - T1548.002 - T1027 | TA0005 - TA0040 | N/A | N/A | Defense Evasion | https://github.com/logangoins/Krueger | 1 | 0 | #GUIDproject | N/A | 9 | 4 | 353 | 42 | 2025-01-06T06:57:14Z | 2024-11-15T20:11:01Z | 20784 |
11 | *023B2DB0-6DA4-4F0D-988B-4D9BF522DA37* | .{0,1000}023B2DB0\-6DA4\-4F0D\-988B\-4D9BF522DA37.{0,1000} | offensive_tool_keyword | C3 | Framework designed for red teams to create and manage custom C2 (Command and Control) channels. Unlike traditional C2 frameworks that rely on typical communication methods like HTTP/S DNS or TCP - C3 allows for the creation of non-traditional and esoteric C2 channels using platforms like Slack Dropbox GitHub OneDrive and more. | T1071 - T1102 - T1090 - T1573 - T1048 | TA0011 - TA0002 - TA0005 - TA0010 | N/A | N/A | C2 | https://github.com/WithSecureLabs/C3 | 1 | 0 | #GUIDproject | N/A | 9 | 10 | 1602 | 276 | 2023-03-04T20:32:13Z | 2019-08-30T11:21:04Z | 20788 |
12 | *025280A3-24F7-4C55-9B5E-D08124A52546* | .{0,1000}025280A3\-24F7\-4C55\-9B5E\-D08124A52546.{0,1000} | offensive_tool_keyword | SharpThief | A one-click program to steal the icon, resource information, version information, modification time, and digital signature (invalid) to make the program appear legitimate | T1036 - T1070 - T1078 - T1027 - T1202 | TA0005 - TA0002 - TA0001 | N/A | N/A | Defense Evasion | https://github.com/INotGreen/SharpThief | 1 | 0 | #GUIDproject | N/A | 8 | 4 | 372 | 37 | 2024-12-17T05:46:39Z | 2024-03-05T05:34:50Z | 20794 |
13 | *027FAC75-3FDB-4044-8DD0-BC297BD4C461* | .{0,1000}027FAC75\-3FDB\-4044\-8DD0\-BC297BD4C461.{0,1000} | offensive_tool_keyword | NetRipper | NetRipper - Smart traffic sniffing for penetration testers | T1173 - T1557 - T1573.001 - T1056.001 | TA0009 - TA0010 | N/A | N/A | Sniffing & Spoofing | https://github.com/NytroRST/NetRipper | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1368 | 318 | 2022-06-17T21:08:54Z | 2015-07-14T20:31:04Z | 20817 |
14 | *027FAC75-3FDB-4044-8DD0-BC297BD4C461* | .{0,1000}027FAC75\-3FDB\-4044\-8DD0\-BC297BD4C461.{0,1000} | offensive_tool_keyword | NetRipper | NetRipper - Smart traffic sniffing for penetration testers | T1173 - T1557 - T1573.001 - T1056.001 | TA0009 - TA0010 | N/A | N/A | Sniffing & Spoofing | https://github.com/NytroRST/NetRipper | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1368 | 318 | 2022-06-17T21:08:54Z | 2015-07-14T20:31:04Z | 20818 |
15 | *027FAC75-3FDB-4044-8DD0-BC297BD4C461* | .{0,1000}027FAC75\-3FDB\-4044\-8DD0\-BC297BD4C461.{0,1000} | offensive_tool_keyword | NetRipper | NetRipper - Smart traffic sniffing for penetration testers | T1173 - T1557 - T1573.001 - T1056.001 | TA0009 - TA0010 | N/A | N/A | Sniffing & Spoofing | https://github.com/NytroRST/NetRipper | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1368 | 318 | 2022-06-17T21:08:54Z | 2015-07-14T20:31:04Z | 20819 |
16 | *027FAC75-3FDB-4044-8DD0-BC297BD4C461* | .{0,1000}027FAC75\-3FDB\-4044\-8DD0\-BC297BD4C461.{0,1000} | offensive_tool_keyword | NetRipper | NetRipper - Smart traffic sniffing for penetration testers | T1173 - T1557 - T1573.001 - T1056.001 | TA0009 - TA0010 | N/A | N/A | Sniffing & Spoofing | https://github.com/NytroRST/NetRipper | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1368 | 318 | 2022-06-17T21:08:54Z | 2015-07-14T20:31:04Z | 20820 |
17 | *027FAC75-3FDB-4044-8DD0-BC297BD4C461* | .{0,1000}027FAC75\-3FDB\-4044\-8DD0\-BC297BD4C461.{0,1000} | offensive_tool_keyword | NetRipper | NetRipper - Smart traffic sniffing for penetration testers | T1173 - T1557 - T1573.001 - T1056.001 | TA0009 - TA0010 | N/A | N/A | Sniffing & Spoofing | https://github.com/NytroRST/NetRipper | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1368 | 318 | 2022-06-17T21:08:54Z | 2015-07-14T20:31:04Z | 20821 |
18 | *0286bd5f-1a56-4251-8758-adb0338d4e98* | .{0,1000}0286bd5f\-1a56\-4251\-8758\-adb0338d4e98.{0,1000} | offensive_tool_keyword | ShimMe | Injects a DLL into a suspended process running as SYSTEM via the OfficeClickToRun service for privilege escalation - Shim Injector: Injects a DLL into a process by modifying shim data in memory without creating or registering new SDB files to evade detection. | T1055 - T1053 - T1548.002 - T1078 - T1546 - T1070 | TA0004 - TA0005 - TA0006 - TA0009 | N/A | N/A | Privilege Escalation | https://github.com/deepinstinct/ShimMe | 1 | 0 | #GUIDproject | N/A | 9 | 2 | 140 | 20 | 2024-10-29T07:33:38Z | 2024-08-04T10:03:28Z | 20824 |
19 | *02948DD6-47BD-4C82-9B4B-78931DB23B8A* | .{0,1000}02948DD6\-47BD\-4C82\-9B4B\-78931DB23B8A.{0,1000} | offensive_tool_keyword | ConfuserEx | ConfuserEx is a widely used open source obfuscator often found in malware | T1027 - T1045 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/yck1509/ConfuserEx | 1 | 0 | #GUIDproject | N/A | 6 | 10 | 3629 | 1661 | 2019-05-14T14:23:56Z | 2014-03-28T07:00:26Z | 20826 |
20 | *02EF15C0-BA19-4115-BB7F-F5B04F7087FE* | .{0,1000}02EF15C0\-BA19\-4115\-BB7F\-F5B04F7087FE.{0,1000} | offensive_tool_keyword | VectorKernel | PoCs for Kernelmode rootkit techniques research. | T1543 - T1055 - T1134 - T1564 - T1070 - T1057 - T1574 - T1562 - T1082 - T1518 | TA0003 - TA0005 - TA0004 - TA0008 - TA0007 | N/A | N/A | Exploitation tool | https://github.com/daem0nc0re/VectorKernel/ | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 367 | 60 | 2025-01-21T08:22:42Z | 2023-11-23T12:36:31Z | 20848 |
21 | *02FAF312-BF2A-466B-8AD2-1339A31C303B* | .{0,1000}02FAF312\-BF2A\-466B\-8AD2\-1339A31C303B.{0,1000} | offensive_tool_keyword | clickjack | automate abuse of clickonce applications | T1210 - T1204 - T1071.001 | TA0001 - TA0002 - TA0005 | N/A | N/A | Phishing | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20861 |
22 | *034B1C28-96B9-486A-B238-9C651EAA32CA* | .{0,1000}034B1C28\-96B9\-486A\-B238\-9C651EAA32CA.{0,1000} | offensive_tool_keyword | ConfuserEx | ConfuserEx is a widely used open source obfuscator often found in malware | T1027 - T1045 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/yck1509/ConfuserEx | 1 | 0 | #GUIDproject | N/A | 6 | 10 | 3629 | 1661 | 2019-05-14T14:23:56Z | 2014-03-28T07:00:26Z | 20886 |
23 | *03652836-898E-4A9F-B781-B7D86E750F60* | .{0,1000}03652836\-898E\-4A9F\-B781\-B7D86E750F60.{0,1000} | offensive_tool_keyword | SharpSCCM | SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI | T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003 | TA0008 - TA0006 - TA0003 - TA0011 | N/A | N/A | Lateral Movement | https://github.com/Mayyhem/SharpSCCM/ | 1 | 0 | #GUIDproject | N/A | 10 | 7 | 626 | 94 | 2024-09-16T14:57:49Z | 2021-08-19T05:09:19Z | 20891 |
24 | *03A09084-0576-45C5-97CA-B83B1A8688B8* | .{0,1000}03A09084\-0576\-45C5\-97CA\-B83B1A8688B8.{0,1000} | greyware_tool_keyword | meshcentral | MeshCentral is a full computer management web site - abused by attackers | T1021 - T1071 - T1090 | TA0003 - TA0008 - TA0011 | N/A | N/A | RMM | https://github.com/Ylianst/MeshAgent | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 264 | 96 | 2025-03-19T18:43:56Z | 2017-10-12T21:26:52Z | 20911 |
25 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20952 |
26 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20953 |
27 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20954 |
28 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20955 |
29 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20956 |
30 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20957 |
31 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20958 |
32 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20959 |
33 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20960 |
34 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20961 |
35 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20962 |
36 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20963 |
37 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20964 |
38 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20965 |
39 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20966 |
40 | *042BF22B-7728-486B-B8C9-D5B91733C46D* | .{0,1000}042BF22B\-7728\-486B\-B8C9\-D5B91733C46D.{0,1000} | offensive_tool_keyword | Tsunami | another C2 framework | T1573 - T1027 - T1059 - T1071 | TA0011 - TA0009 - TA0003 - TA0007 - TA0008 | N/A | N/A | C2 | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 20967 |
41 | *043EE329-C00A-4F67-971F-BF1C55D4BC1A* | .{0,1000}043EE329\-C00A\-4F67\-971F\-BF1C55D4BC1A.{0,1000} | offensive_tool_keyword | Malware RAT collection | from Malware RAT samples | T1105 - T1059 - T1109 - T1016 - T1071.001 - T1082 - T1027 - T1083 - T1056 - T1106 - T1078 - T1053 | TA0011 - TA0009 - TA0006 - TA0003 - TA0002 - TA0005 - TA0007 | N/A | N/A | Malware | https://github.com/x-cod3r/Remote-administration-tools-archive | 1 | 0 | #GUIDproject | N/A | 9 | 1 | 93 | 30 | 2023-10-03T15:08:22Z | 2023-10-03T13:09:00Z | 20975 |
42 | *0472A393-9503-491D-B6DA-FA47CD567EDE* | .{0,1000}0472A393\-9503\-491D\-B6DA\-FA47CD567EDE.{0,1000} | offensive_tool_keyword | ntdlll-unhooking-collection | unhooking ntdll from disk - from KnownDlls - from suspended process - from remote server (fileless) | T1055 - T1055.001 - T1070 - T1070.004 - T1101 - T1574 - T1574.002 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/TheD1rkMtr/ntdlll-unhooking-collection | 1 | 0 | #GUIDproject | N/A | 9 | 2 | 188 | 38 | 2023-08-02T02:26:33Z | 2023-02-07T16:54:15Z | 20990 |
43 | *04DFB6E4-809E-4C35-88A1-2CC5F1EBFEBD* | .{0,1000}04DFB6E4\-809E\-4C35\-88A1\-2CC5F1EBFEBD.{0,1000} | offensive_tool_keyword | EDRSandBlast | EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections | T1547.002 - T1055.001 - T1205 | TA0004 - TA0005 | N/A | COZY BEAR | Defense Evasion | https://github.com/wavestone-cdt/EDRSandblast | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1633 | 292 | 2024-08-30T20:30:31Z | 2021-11-02T15:02:42Z | 21012 |
44 | *04DFB6E4-809E-4C35-88A1-2CC5F1EBFEBD* | .{0,1000}04DFB6E4\-809E\-4C35\-88A1\-2CC5F1EBFEBD.{0,1000} | offensive_tool_keyword | EDRSandblast-GodFault | Integrates GodFault into EDR Sandblast achieving the same result without the use of any vulnerable drivers. | T1547.002 - T1055.001 - T1205 | TA0004 - TA0005 | N/A | COZY BEAR | Defense Evasion | https://github.com/gabriellandau/EDRSandblast-GodFault | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 260 | 48 | 2023-08-28T18:14:20Z | 2023-06-01T19:32:09Z | 21013 |
45 | *04FC654C-D89A-44F9-9E34-6D95CE152E9D* | .{0,1000}04FC654C\-D89A\-44F9\-9E34\-6D95CE152E9D.{0,1000} | offensive_tool_keyword | PrivFu | Kernel mode WinDbg extension and PoCs for token privilege investigation. | T1016 - T1018 - T1098 - T1134 - T1055 - T1053 - T1059 - T1035 - T1547.001 - T1547.004 - T1548.001 | TA0007 - TA0008 - TA0002 - TA0004 | N/A | N/A | Privilege Escalation | https://github.com/daem0nc0re/PrivFu | 1 | 0 | #GUIDproject | N/A | 10 | 9 | 849 | 122 | 2025-01-21T05:22:50Z | 2021-12-28T13:14:25Z | 21020 |
46 | *0527a14f-1591-4d94-943e-d6d784a50549* | .{0,1000}0527a14f\-1591\-4d94\-943e\-d6d784a50549.{0,1000} | offensive_tool_keyword | BadPotato | Windows Privilege Escalation Exploit BadPotato | T1134.001 - T1068 - T1055 - T1546.015 | TA0004 - TA0006 - TA0011 | Ghost Ransomware | Earth Lusca | Privilege Escalation | https://github.com/BeichenDream/BadPotato | 1 | 0 | #GUIDproject | N/A | 10 | 9 | 836 | 136 | 2020-05-10T15:42:21Z | 2020-05-10T10:01:20Z | 21039 |
47 | *052C26C0-7979-4555-89CE-34C5CE8D8B34* | .{0,1000}052C26C0\-7979\-4555\-89CE\-34C5CE8D8B34.{0,1000} | offensive_tool_keyword | RevengeRAT-Stub-Cssharp | RevengeRAT - AsyncRAT Simple RAT | T1219 - T1055 - T1569.002 - T1035 - T1071 - T1105 | TA0005 - TA0042 - TA0011 | N/A | TA2541 - APT-C-36 | C2 | https://github.com/NYAN-x-CAT/RevengeRAT-Stub-Cssharp | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 92 | 39 | 2020-03-02T11:34:36Z | 2019-09-15T09:39:07Z | 21040 |
48 | *055BC73F-FCAE-4361-B035-2E156A101EA9* | .{0,1000}055BC73F\-FCAE\-4361\-B035\-2E156A101EA9.{0,1000} | offensive_tool_keyword | ConfuserEx | ConfuserEx is a widely used open source obfuscator often found in malware | T1027 - T1045 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/yck1509/ConfuserEx | 1 | 0 | #GUIDproject | N/A | 6 | 10 | 3629 | 1661 | 2019-05-14T14:23:56Z | 2014-03-28T07:00:26Z | 21048 |
49 | *05B4EB7F-3D59-4E6A-A7BC-7C1241578CA7* | .{0,1000}05B4EB7F\-3D59\-4E6A\-A7BC\-7C1241578CA7.{0,1000} | offensive_tool_keyword | Cronos-Rootkit | Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes. protect and elevate them with token manipulation. | T1055 - T1078 - T1134 - T1562.001 | TA0001 - TA0003 - TA0004 - TA0005 | N/A | N/A | Persistence | https://github.com/XaFF-XaFF/Cronos-Rootkit | 1 | 0 | #GUIDproject | N/A | N/A | 9 | 899 | 186 | 2022-03-29T08:26:03Z | 2021-08-25T08:54:45Z | 21069 |
50 | *06AF1D64-F2FC-4767-8794-7313C7BB0A40* | .{0,1000}06AF1D64\-F2FC\-4767\-8794\-7313C7BB0A40.{0,1000} | offensive_tool_keyword | r77-rootkit | Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections | T1014 - T1055 - T1055.013 - T1060 - T1106 - T1070.009 | TA0005 - TA0003 | N/A | N/A | Persistence | https://github.com/bytecode77/r77-rootkit | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1884 | 425 | 2025-03-25T17:59:20Z | 2017-12-17T13:04:14Z | 21127 |
51 | *06B2AE2B-7FD3-4C36-B825-1594752B1D7B* | .{0,1000}06B2AE2B\-7FD3\-4C36\-B825\-1594752B1D7B.{0,1000} | offensive_tool_keyword | Cable | *.NET post-exploitation toolkit for Active Directory reconnaissance and exploitation* | T1087 - T1016 - T1059 - T1482 - T1078 | TA0007 - TA0002 - TA0003 - TA0005 | N/A | N/A | Discovery | https://github.com/logangoins/Cable | 1 | 0 | #GUIDproject | N/A | 7 | 4 | 361 | 40 | 2025-04-09T01:12:47Z | 2024-08-10T19:47:08Z | 21128 |
52 | *06B2B14A-CE87-41C0-A77A-2644FE3231C7* | .{0,1000}06B2B14A\-CE87\-41C0\-A77A\-2644FE3231C7.{0,1000} | offensive_tool_keyword | xeno-rat | Xeno-RAT is an open-source remote access tool (RAT) developed in C# providing a comprehensive set of features for remote system management. Has features such as HVNC - live microphone - reverse proxy and much much more | T1133 - T1021.001 - T1563.002 - T1113 - T1123 - T1571 - T1090 | TA0001 - TA0002 - TA0003 - TA0005 - TA0006 - TA0009 - TA0011 | N/A | N/A | C2 | https://github.com/moom825/xeno-rat | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1225 | 323 | 2024-03-05T06:22:36Z | 2023-10-17T06:41:56Z | 21129 |
53 | *07628592-5A22-4C0A-9330-6C90BD7A94B6* | .{0,1000}07628592\-5A22\-4C0A\-9330\-6C90BD7A94B6.{0,1000} | offensive_tool_keyword | LocalAdminSharp | .NET executable to use when dealing with privilege escalation on Windows to gain local administrator access | T1055.011 - T1068 - T1548.002 - T1548.003 - T1548.004 | TA0004 | N/A | N/A | Privilege Escalation | https://github.com/notdodo/LocalAdminSharp | 1 | 0 | #GUIDproject | N/A | 10 | 2 | 157 | 17 | 2022-11-01T17:45:43Z | 2022-01-01T10:35:09Z | 21183 |
54 | *07DFC5AA-5B1F-4CCC-A3D3-816ECCBB6CB6* | .{0,1000}07DFC5AA\-5B1F\-4CCC\-A3D3\-816ECCBB6CB6.{0,1000} | offensive_tool_keyword | SharpBlackout | Terminate AV/EDR leveraging BYOVD attack | T1562.001 - T1050.005 | TA0005 - TA0003 | N/A | N/A | Defense Evasion | https://github.com/dmcxblue/SharpBlackout | 1 | 0 | #GUIDproject | N/A | 10 | 1 | 83 | 20 | 2025-03-21T16:33:42Z | 2023-08-23T14:16:40Z | 21217 |
55 | *07EF7652-1C2D-478B-BB4B-F9560695A387* | .{0,1000}07EF7652\-1C2D\-478B\-BB4B\-F9560695A387.{0,1000} | offensive_tool_keyword | UACME | Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor. | T1548 - T1547 - T1218 | TA0002 - TA0005 - TA0004 | N/A | Evilnum | Defense Evasion | https://github.com/hfiref0x/UACME | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 6711 | 1348 | 2025-03-09T03:33:26Z | 2015-03-28T12:04:33Z | 21224 |
56 | *080A880D-BA94-4CF8-9015-5B2063073E02* | .{0,1000}080A880D\-BA94\-4CF8\-9015\-5B2063073E02.{0,1000} | offensive_tool_keyword | metasploit | Metasploit is a widely-used. open-source framework designed for penetration testing. vulnerability assessment. and exploit development. It provides security professionals and researchers with a comprehensive platform to discover. exploit. and validate vulnerabilities in computer systems and networks. Metasploit includes a large database of pre-built exploits. payloads. and auxiliary modules that can be used to test various attack vectors. identify security weaknesses. and simulate real-world cyberattacks. By utilizing Metasploit. security teams can better understand potential threats and improve their overall security posture. | T1001 - T1021 - T1024 - T1033 - T1047 - T1075 - T1059 - T1064 - T1090 - T1204 -T1210 - T1218 | TA0001 - TA0002 - TA0003 - TA0004 - TA0005 - TA0006 - TA0007 - TA0008 - TA0009 - TA0011 - TA0010 - TA0040 | N/A | FANCY BEAR - EMBER BEAR - Sandworm - Turla - MAZE - LockBit - Bassterlord* - Conti - Hive - Fog - Black Basta - MoneyTaker - INDRIK SPIDER - APT39 - GOLD DUPONT - Common Raven | Framework | https://github.com/rapid7/metasploit-omnibus | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 268 | 213 | 2025-04-18T13:17:56Z | 2015-02-26T18:42:09Z | 21234 |
57 | *0845B3E9-B6AE-4227-B484-CECBC2EB1C87* | .{0,1000}0845B3E9\-B6AE\-4227\-B484\-CECBC2EB1C87.{0,1000} | offensive_tool_keyword | Carbanak | remote backdoor used by a group of the same name (Carbanak). It is intended for espionage - data exfiltration and providing remote access to infected machines | T1021.002 - T1071.001 - T1105 - T1059 - T1003 - T1078 - T1041 | TA0006 - TA0008 - TA0010 - TA0011 | Carbanak | FIN7 - Carbanak | Malware | https://github.com/0x25bit/Updated-Carbanak-Source-with-Plugins | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 396 | 223 | 2019-05-01T23:31:35Z | 2019-04-22T21:01:08Z | 21258 |
58 | *089CA7D6-3277-4998-86AF-F6413290A442* | .{0,1000}089CA7D6\-3277\-4998\-86AF\-F6413290A442.{0,1000} | offensive_tool_keyword | defender-control | An open-source windows defender manager. Now you can disable windows defender permanently | T1562.001 - T1562.004 - T1089 | TA0005 - TA0002 | N/A | LockBit | Defense Evasion | https://github.com/pgkt04/defender-control | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1614 | 128 | 2023-09-09T14:57:56Z | 2021-05-15T10:09:17Z | 21282 |
59 | *08AEC00F-42ED-4E62-AE8D-0BFCE30A3F57* | .{0,1000}08AEC00F\-42ED\-4E62\-AE8D\-0BFCE30A3F57.{0,1000} | offensive_tool_keyword | WDExtract | Extract Windows Defender database from vdm files and unpack it | T1059 - T1005 - T1119 | TA0002 - TA0009 - TA0003 | N/A | N/A | Defense Evasion | https://github.com/hfiref0x/WDExtract/ | 1 | 0 | #GUIDproject | N/A | 8 | 5 | 440 | 61 | 2020-02-10T06:53:43Z | 2019-04-19T17:33:48Z | 21287 |
60 | *08DBC2BF-E9F3-4AE4-B0CC-6E9C8767982D* | .{0,1000}08DBC2BF\-E9F3\-4AE4\-B0CC\-6E9C8767982D.{0,1000} | offensive_tool_keyword | OSEP-Code-Snippets | notable code snippets for Offensive Security's PEN-300 (OSEP) course | T1116 - T1204.002 - T1027.009 - T1021.005 - T1560.001 - T1100 - T1003.001 - T1564.001 - T1047 - T1210 - T1134.002 - T1055 - T1055.011 - T1055.012 - T1204 | TA0005 - TA0040 - TA0008 - TA0003 - TA0006 - TA0004 | N/A | N/A | Exploitation tool | https://github.com/chvancooten/OSEP-Code-Snippets | 1 | 0 | #GUIDproject | N/A | 8 | 10 | 1254 | 444 | 2024-01-04T15:17:17Z | 2021-03-10T21:34:41Z | 21299 |
61 | *09323E4D-BE0F-452A-9CA8-B07D2CFA9804* | .{0,1000}09323E4D\-BE0F\-452A\-9CA8\-B07D2CFA9804.{0,1000} | offensive_tool_keyword | COM-Hunter | COM-hunter is a COM Hijacking persistnce tool written in C# | T1122 - T1055.012 | TA0003 - TA0005 | N/A | N/A | Persistence | https://github.com/nickvourd/COM-Hunter | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 289 | 48 | 2025-03-11T04:49:55Z | 2022-05-26T19:34:59Z | 21323 |
62 | *0971A047-A45A-43F4-B7D8-16AC1114B524* | .{0,1000}0971A047\-A45A\-43F4\-B7D8\-16AC1114B524.{0,1000} | offensive_tool_keyword | BackupOperatorToDA | From an account member of the group Backup Operators to Domain Admin without RDP or WinRM on the Domain Controller | T1078 - T1078.003 - T1021 - T1021.006 - T1112 - T1003.003 | TA0005 - TA0001 - TA0003 | N/A | N/A | Privilege Escalation | https://github.com/mpgn/BackupOperatorToDA | 1 | 0 | #GUIDproject | N/A | 10 | 5 | 421 | 53 | 2025-01-04T14:16:46Z | 2022-02-15T20:51:46Z | 21341 |
63 | *0A1C2C46-33F7-4D4C-B8C6-1FC9B116A6DF* | .{0,1000}0A1C2C46\-33F7\-4D4C\-B8C6\-1FC9B116A6DF.{0,1000} | offensive_tool_keyword | DllNotificationInjection | A POC of a new threadless process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and remote processes. | T1055.011 - T1055.001 | TA0005 - TA0002 | N/A | N/A | Defense Evasion | https://github.com/ShorSec/DllNotificationInjection | 1 | 0 | #GUIDproject | N/A | 10 | 1 | 23 | 3 | 2023-08-23T13:50:27Z | 2023-12-01T12:47:43Z | 21390 |
64 | *0A2B3F8A-EDC2-48B5-A5FC-DE2AC57C8990* | .{0,1000}0A2B3F8A\-EDC2\-48B5\-A5FC\-DE2AC57C8990.{0,1000} | offensive_tool_keyword | EventCleaner | erase specified records from Windows event logs | T1070.001 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/QAX-A-Team/EventCleaner | 1 | 0 | #GUIDproject | N/A | 10 | 6 | 599 | 148 | 2018-09-07T11:02:01Z | 2018-07-27T07:37:32Z | 21393 |
65 | *0A78E156-D03F-4667-B70E-4E9B4AA1D491* | .{0,1000}0A78E156\-D03F\-4667\-B70E\-4E9B4AA1D491.{0,1000} | offensive_tool_keyword | PrivFu | PoCs for sensitive token privileges such SeDebugPrivilege | T1068 - T1134 - T1134.001 - T1078 - T1059 | TA0004 - TA0009 - TA0003 | N/A | N/A | Privilege Escalation | https://github.com/daem0nc0re/PrivFu | 1 | 0 | #GUIDproject | PrivilegedOperations | 10 | 9 | 849 | 122 | 2025-01-21T05:22:50Z | 2021-12-28T13:14:25Z | 21409 |
66 | *0ABB9F2A-6913-4174-9431-851F9D3E94B4* | .{0,1000}0ABB9F2A\-6913\-4174\-9431\-851F9D3E94B4.{0,1000} | offensive_tool_keyword | RPC-Backdoor | A basic emulation of an "RPC Backdoor" | T1071.004 | TA0011 | N/A | N/A | C2 | https://github.com/eladshamir/RPC-Backdoor | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 240 | 45 | 2022-08-25T14:37:41Z | 2022-08-16T13:12:05Z | 21422 |
67 | *0ADFD1F0-7C15-4A22-87B4-F67E046ECD96* | .{0,1000}0ADFD1F0\-7C15\-4A22\-87B4\-F67E046ECD96.{0,1000} | offensive_tool_keyword | TokenPlayer | Manipulating and Abusing Windows Access Tokens | T1134 - T1484 - T1055 - T1078 | TA0004 - TA0005 - TA0006 | N/A | N/A | Privilege Escalation | https://github.com/S1ckB0y1337/TokenPlayer | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 274 | 45 | 2021-01-15T16:07:47Z | 2020-08-20T23:05:49Z | 21433 |
68 | *0B6D8B01-861E-4CAF-B1C9-6670884381DB* | .{0,1000}0B6D8B01\-861E\-4CAF\-B1C9\-6670884381DB.{0,1000} | offensive_tool_keyword | openbullet | The OpenBullet web testing application. | T1211 - T1211.002 - T1254 - T1254.001 - T1190 - T1190.001 | TA0005 - TA0001 | N/A | N/A | Vulnerability Scanner | https://github.com/openbullet/openbullet | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1569 | 697 | 2024-09-02T12:18:29Z | 2019-03-26T09:06:32Z | 21468 |
69 | *0BD5DE6B-8DA5-4CF1-AE53-A265010F52AA* | .{0,1000}0BD5DE6B\-8DA5\-4CF1\-AE53\-A265010F52AA.{0,1000} | offensive_tool_keyword | mimikatz | mimikatz GUID project | T1134.005 - T1098 - T1547.005 - T1555 - T1555.003 - T1555.004 - T1003.001 - T1003.002 - T1003.004 - T1003.006 - T1207 - T1649 - T1558.001 - T1558.002 - T1552.004 - T1550.002 - T1550.003 | TA0004 - TA0006 - TA0003 - TA0008 - TA0009 | N/A | Black Basta - APT1 - APT24 - APT28 - APT29 - APT32 - APT33 - APT38 - APT39 - APT41 - APT5 - Akira - Avivore - BERSERK BEAR - BOSS SPIDER - BRONZE BUTLER - BackdoorDiplomacy - Blue Mockingbird - CHRYSENE - COZY BEAR - Carbanak - Chamelgang - Chimera - Cleaver - Cobalt Group - DarkHydrus - Dragonfly - Earth Lusca - FANCY BEAR - FIN13 - FIN6 - FIN7 - GALLIUM - Gamaredon - HEXANE - Indrik Spider - Ke3chang - Kimsuky - LAPSUS$ - Leafminer - Magic Hound - MuddyWater - OilRig - PittyTiger - Sandworm Team - Scattered Spider - TA505 - TEMP.Veles - Threat Group-3390 - Thrip - Tonto Team - Turla - Unit 29155 - Volt Typhoon - Whitefly - Wizard Spider - menuPass - Dispossessor - DragonForce - Sphinx | Credential Access | https://github.com/gentilkiwi/mimikatz | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 20094 | 3854 | 2024-07-05T17:42:58Z | 2014-04-06T18:30:02Z | 21500 |
70 | *0C117EE5-2A21-496D-AF31-8CC7F0CAAA86* | .{0,1000}0C117EE5\-2A21\-496D\-AF31\-8CC7F0CAAA86.{0,1000} | offensive_tool_keyword | UnstoppableService | a Windows service in C# that is self installing as a single executable and sets proper attributes to prevent an administrator from stopping or pausing the service through the Windows Service Control Manager interface | T1543.003 - T1564.001 - T1490 | TA0003 - TA0005 | N/A | N/A | Persistence | https://github.com/malcomvetter/UnstoppableService | 1 | 0 | #GUIDProject | N/A | 5 | 1 | 66 | 15 | 2019-01-19T22:38:18Z | 2018-08-07T22:11:22Z | 21514 |
71 | *0C3EB2F7-92BA-4895-99FC-7098A16FFE8C* | .{0,1000}0C3EB2F7\-92BA\-4895\-99FC\-7098A16FFE8C.{0,1000} | offensive_tool_keyword | KeeFarce | Extracts passwords from a KeePass 2.x database directly from memory | T1003 - T1055 - T1059 | TA0006 | N/A | N/A | Credential Access | https://github.com/denandz/KeeFarce | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1009 | 132 | 2015-11-17T04:12:25Z | 2015-10-27T05:29:04Z | 21532 |
72 | *0C81C7D4-736A-4876-A36E-15E5B2EF5117* | .{0,1000}0C81C7D4\-736A\-4876\-A36E\-15E5B2EF5117.{0,1000} | offensive_tool_keyword | ChromeKatz | Dump cookies directly from Chrome process memory | T1555.003 - T1003 | TA0006 - TA0009 | N/A | N/A | Credential Access | https://github.com/Meckazin/ChromeKatz | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1171 | 115 | 2024-11-26T12:53:22Z | 2023-12-07T22:27:06Z | 21552 |
73 | *0C89EC7D-AC60-4591-8F6B-CB5F20EC0D8D* | .{0,1000}0C89EC7D\-AC60\-4591\-8F6B\-CB5F20EC0D8D.{0,1000} | offensive_tool_keyword | VectorKernel | PoCs for Kernelmode rootkit techniques research. | T1543 - T1055 - T1134 - T1564 - T1070 - T1057 - T1574 - T1562 - T1082 - T1518 | TA0003 - TA0005 - TA0004 - TA0008 - TA0007 | N/A | N/A | Exploitation tool | https://github.com/daem0nc0re/VectorKernel/ | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 367 | 60 | 2025-01-21T08:22:42Z | 2023-11-23T12:36:31Z | 21553 |
74 | *0C8F49D8-BD68-420A-907D-031B83737C50* | .{0,1000}0C8F49D8\-BD68\-420A\-907D\-031B83737C50.{0,1000} | offensive_tool_keyword | ConfuserEx | ConfuserEx is a widely used open source obfuscator often found in malware | T1027 - T1045 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/yck1509/ConfuserEx | 1 | 0 | #GUIDproject | N/A | 6 | 10 | 3629 | 1661 | 2019-05-14T14:23:56Z | 2014-03-28T07:00:26Z | 21555 |
75 | *0CC923FB-E1FD-456B-9FE4-9EBA5A3DC2FC* | .{0,1000}0CC923FB\-E1FD\-456B\-9FE4\-9EBA5A3DC2FC.{0,1000} | offensive_tool_keyword | PrivFu | ArtsOfGetSystem privesc tools | T1134 - T1134.001 - T1078 - T1059 - T1075 | TA0004 | N/A | N/A | Privilege Escalation | https://github.com/daem0nc0re/PrivFu/ | 1 | 0 | #GUIDproject | ArtsOfGetSystem | 10 | 9 | 849 | 122 | 2025-01-21T05:22:50Z | 2021-12-28T13:14:25Z | 21574 |
76 | *0CD16C7B-2A65-44E5-AB74-843BD23241D3* | .{0,1000}0CD16C7B\-2A65\-44E5\-AB74\-843BD23241D3.{0,1000} | offensive_tool_keyword | PrintNightmare | PrintNightmare exploitation | T1210 - T1059.001 - T1548.002 | TA0001 - TA0002 - TA0004 | N/A | Dispossessor | Privilege Escalation | https://github.com/outflanknl/PrintNightmare | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 337 | 67 | 2021-09-13T08:45:26Z | 2021-09-13T08:44:02Z | 21577 |
77 | *0D17A4B4-A7C4-49C0-99E3-B856F9F3B271* | .{0,1000}0D17A4B4\-A7C4\-49C0\-99E3\-B856F9F3B271.{0,1000} | offensive_tool_keyword | mhydeath | Abusing mhyprotect to kill AVs / EDRs / XDRs / Protected Processes. | T1562.001 | TA0040 - TA0005 | N/A | Black Basta | Defense Evasion | https://github.com/zer0condition/mhydeath | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 397 | 71 | 2023-08-22T08:01:04Z | 2023-08-22T07:15:36Z | 21603 |
78 | *0DD419E5-D7B3-4360-874E-5838A7519355* | .{0,1000}0DD419E5\-D7B3\-4360\-874E\-5838A7519355.{0,1000} | offensive_tool_keyword | CheeseTools | tools for Lateral Movement/Code Execution | T1021.006 - T1059.003 - T1105 | TA0008 - TA0002 | N/A | N/A | Lateral Movement | https://github.com/klezVirus/CheeseTools | 1 | 0 | #GUIDproject | N/A | 10 | 8 | 706 | 143 | 2021-08-17T20:22:56Z | 2020-08-24T01:28:12Z | 21660 |
79 | *0DE8DA5D-061D-4649-8A56-48729CF1F789* | .{0,1000}0DE8DA5D\-061D\-4649\-8A56\-48729CF1F789.{0,1000} | offensive_tool_keyword | AsyncRAT-C-Sharp | Open-Source Remote Administration Tool For Windows C# (RAT) | T1021.002 - T1056.001 - T1113 - T1133 - T1041 - T1555 - T1129 - T1564.001 | TA0001 - TA0002 - TA0003 - TA0005 - TA0006 - TA0009 | N/A | TA2541 - APT-C-36 - Earth Berberoka - Operation Comando - TA558 | C2 | https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 2484 | 754 | 2023-10-16T21:41:12Z | 2019-01-19T04:02:26Z | 21665 |
80 | *0DF38AD4-60AF-4F93-9C7A-7FB7BA692017* | .{0,1000}0DF38AD4\-60AF\-4F93\-9C7A\-7FB7BA692017.{0,1000} | offensive_tool_keyword | Volumiser | Volumiser is a command line tool and interactive console GUI for listing - browsing and extracting files from common virtual machine hard disk image formats. | T1560.001 - T1059 - T1114 - T1005 | TA0005 - TA0009 | N/A | N/A | Collection | https://github.com/CCob/Volumiser | 1 | 0 | #GUIDproject | N/A | 7 | 4 | 379 | 42 | 2025-04-22T15:47:53Z | 2022-11-08T21:38:56Z | 21671 |
81 | *0DF612AE-47D8-422C-B0C5-0727EA60784F* | .{0,1000}0DF612AE\-47D8\-422C\-B0C5\-0727EA60784F.{0,1000} | offensive_tool_keyword | NativeDump | Dump lsass using only Native APIs by hand-crafting Minidump files (without MinidumpWriteDump!) | T1003.001 | TA0006 | N/A | N/A | Credential Access | https://github.com/ricardojoserf/NativeDump | 1 | 0 | #GUIDproject | N/A | 10 | 6 | 586 | 86 | 2024-12-17T15:36:57Z | 2024-02-22T15:16:16Z | 21673 |
82 | *0E423DD6-FAAF-4A66-8828-6A5A5F22269B* | .{0,1000}0E423DD6\-FAAF\-4A66\-8828\-6A5A5F22269B.{0,1000} | offensive_tool_keyword | DcRat | DcRat C2 A simple remote tool in C# | T1071 - T1021 - T1003 | TA0011 | N/A | N/A | Malware | https://github.com/qwqdanchun/DcRat | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 968 | 332 | 2022-02-07T05:37:09Z | 2021-03-12T11:00:37Z | 21696 |
83 | *0E4BAB8F-E6E0-47A8-8E99-8D451839967E* | .{0,1000}0E4BAB8F\-E6E0\-47A8\-8E99\-8D451839967E.{0,1000} | offensive_tool_keyword | EfiGuard | EfiGuard is a portable x64 UEFI bootkit that patches the Windows boot manager - boot loader and kernel at boot time in order to disable PatchGuard and Driver Signature Enforcement (DSE). | T1542.002 - T1542.003 - T1542.004 | TA0003 - TA0005 | N/A | N/A | Defense Evasion | https://github.com/Mattiwatti/EfiGuard | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1977 | 354 | 2025-02-24T11:57:36Z | 2019-03-25T19:47:39Z | 21698 |
84 | *0E5D043A-CAA1-40C7-A616-773F347FA43F* | .{0,1000}0E5D043A\-CAA1\-40C7\-A616\-773F347FA43F.{0,1000} | greyware_tool_keyword | pingcastle | active directory weakness scan Vulnerability scanner | T1016 - T1069.002 - T1087.002 - T1485 | TA0007 - TA0008 | N/A | MAZE - BianLian - Scattered Spider* - DragonForce | Vulnerability Scanner | https://github.com/netwrix/pingcastle | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 2486 | 303 | 2025-02-28T10:16:24Z | 2018-08-31T17:42:48Z | 21702 |
85 | *0FE0D049-F352-477D-BCCD-ACBF7D4F6F15* | .{0,1000}0FE0D049\-F352\-477D\-BCCD\-ACBF7D4F6F15.{0,1000} | offensive_tool_keyword | EvilSln | A New Exploitation Technique for Visual Studio Projects | T1564.001 - T1204.002 | TA0005 - TA0002 | N/A | N/A | Defense Evasion | https://github.com/cjm00n/EvilSln | 1 | 0 | #GUIDproject | N/A | 10 | N/A | 21818 | ||||
86 | *105C2C6D-1C0A-4535-A231-80E355EFB112* | .{0,1000}105C2C6D\-1C0A\-4535\-A231\-80E355EFB112.{0,1000} | offensive_tool_keyword | RoguePotato | Windows Local Privilege Escalation from Service Account to System | T1055.002 - T1078.003 - T1070.004 | TA0005 - TA0004 - TA0002 | N/A | N/A | Privilege Escalation | https://github.com/antonioCoco/RoguePotato | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1081 | 131 | 2021-01-09T20:43:07Z | 2020-05-10T17:38:28Z | 21888 |
87 | *107EBC1B-0273-4B3D-B676-DE64B7F52B33* | .{0,1000}107EBC1B\-0273\-4B3D\-B676\-DE64B7F52B33.{0,1000} | offensive_tool_keyword | SharpPersistSD | A Post-Compromise granular .NET library to embed persistency to persistency by abusing Security Descriptors of remote machines | T1547 - T1053 - T1027 - T1028 - T1112 | TA0003 - TA0008 | N/A | N/A | Persistence | https://github.com/cybersectroll/SharpPersistSD | 1 | 0 | #GUIDproject | N/A | 10 | 1 | 87 | 12 | 2024-05-15T14:55:14Z | 2024-05-13T15:11:12Z | 21897 |
88 | *10CC4D5B-DC87-4AEB-887B-E47367BF656B* | .{0,1000}10CC4D5B\-DC87\-4AEB\-887B\-E47367BF656B.{0,1000} | offensive_tool_keyword | FormThief | Spoofing desktop login applications with WinForms and WPF | T1204.002 - T1056.004 - T1071.001 | TA0001 - TA0006 | N/A | N/A | Credential Access | https://github.com/mlcsec/FormThief | 1 | 0 | #GUIDproject | N/A | 8 | 2 | 173 | 31 | 2024-02-19T22:40:09Z | 2024-02-19T22:34:07Z | 21915 |
89 | *111BB935-2A0A-4AE2-AEB0-EF2FAA529840* | .{0,1000}111BB935\-2A0A\-4AE2\-AEB0\-EF2FAA529840.{0,1000} | offensive_tool_keyword | Malware RAT collection | from Malware RAT samples | T1105 - T1059 - T1109 - T1016 - T1071.001 - T1082 - T1027 - T1083 - T1056 - T1106 - T1078 - T1053 | TA0011 - TA0009 - TA0006 - TA0003 - TA0002 - TA0005 - TA0007 | N/A | N/A | Malware | https://github.com/x-cod3r/Remote-administration-tools-archive | 1 | 0 | #GUIDproject | N/A | 9 | 1 | 93 | 30 | 2023-10-03T15:08:22Z | 2023-10-03T13:09:00Z | 21947 |
90 | *11385CC1-54B7-4968-9052-DF8BB1961F1E* | .{0,1000}11385CC1\-54B7\-4968\-9052\-DF8BB1961F1E.{0,1000} | offensive_tool_keyword | Shellcode-Hide | simple shellcode Loader - Encoders (base64 - custom - UUID - IPv4 - MAC) - Encryptors (AES) - Fileless Loader (Winhttp socket) | T1059.003 - T1027 - T1132 - T1027.002 - T1045 - T1027.004 - T1105 | TA0005 - TA0001 - TA0003 | N/A | N/A | Defense Evasion | https://github.com/TheD1rkMtr/Shellcode-Hide | 1 | 0 | #GUIDproject | N/A | 9 | 5 | 416 | 109 | 2023-08-02T02:22:20Z | 2023-02-05T17:31:43Z | 21954 |
91 | *116472CE-3924-40EA-90F9-50A1A00D0EC5* | .{0,1000}116472CE\-3924\-40EA\-90F9\-50A1A00D0EC5.{0,1000} | offensive_tool_keyword | Lime-RAT | remote administration tool for Windows (RAT) | T1059 - T1573.001 - T1027 - T1091 - T1486 - T1036 - T1560 - T1566 - T1480 - T1498 - T1113 - T1083 - T1016 - T1105 - T1056 - T1021 - T1112 - T1082 - T1072 - T1076 - T1078 - T1209 - T1003 - T1012 - T1100 - T1135 - T1108 - T1029 - T1547 - T1053 - T1060 - T1102 - T1124 - T1049 - T1123 - T1145 - T1210 - T1046 - T1010 - T1055 | TA0040 - TA0010 - TA0005 - TA0011 - TA0043 - TA0006 - TA0042 - TA0008 - TA0009 - TA0007 - TA0002 - TA0003 | N/A | APT-C-36 - Operation Comando | Malware | https://github.com/NYAN-x-CAT/Lime-RAT | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1086 | 413 | 2019-06-24T17:05:48Z | 2018-02-07T15:35:56Z | 21967 |
92 | *1250BAE1-D26F-4EF2-9452-9B5009568336* | .{0,1000}1250BAE1\-D26F\-4EF2\-9452\-9B5009568336.{0,1000} | offensive_tool_keyword | VectorKernel | PoCs for Kernelmode rootkit techniques research. | T1543 - T1055 - T1134 - T1564 - T1070 - T1057 - T1574 - T1562 - T1082 - T1518 | TA0003 - TA0005 - TA0004 - TA0008 - TA0007 | N/A | N/A | Exploitation tool | https://github.com/daem0nc0re/VectorKernel/ | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 367 | 60 | 2025-01-21T08:22:42Z | 2023-11-23T12:36:31Z | 22028 |
93 | *128C450F-C8B3-403A-9D0C-E5AD6B7F566F* | .{0,1000}128C450F\-C8B3\-403A\-9D0C\-E5AD6B7F566F.{0,1000} | greyware_tool_keyword | meshcentral | MeshCentral is a full computer management web site - abused by attackers | T1021 - T1071 - T1090 | TA0003 - TA0008 - TA0011 | N/A | N/A | RMM | https://github.com/Ylianst/MeshAgent | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 264 | 96 | 2025-03-19T18:43:56Z | 2017-10-12T21:26:52Z | 22065 |
94 | *13431429-2DB6-480F-B73F-CA019FE759E3* | .{0,1000}13431429\-2DB6\-480F\-B73F\-CA019FE759E3.{0,1000} | offensive_tool_keyword | ConfuserEx | ConfuserEx is a widely used open source obfuscator often found in malware | T1027 - T1045 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/yck1509/ConfuserEx | 1 | 0 | #GUIDproject | N/A | 6 | 10 | 3629 | 1661 | 2019-05-14T14:23:56Z | 2014-03-28T07:00:26Z | 22121 |
95 | *13A59BB8-0246-4FFA-951B-89B9A341F159* | .{0,1000}13A59BB8\-0246\-4FFA\-951B\-89B9A341F159.{0,1000} | offensive_tool_keyword | xeno-rat | Xeno-RAT is an open-source remote access tool (RAT) developed in C# providing a comprehensive set of features for remote system management. Has features such as HVNC - live microphone - reverse proxy and much much more | T1133 - T1021.001 - T1563.002 - T1113 - T1123 - T1571 - T1090 | TA0001 - TA0002 - TA0003 - TA0005 - TA0006 - TA0009 - TA0011 | N/A | N/A | C2 | https://github.com/moom825/xeno-rat | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1225 | 323 | 2024-03-05T06:22:36Z | 2023-10-17T06:41:56Z | 22146 |
96 | *13C57810-FF18-4258-ABC9-935040A54F0B* | .{0,1000}13C57810\-FF18\-4258\-ABC9\-935040A54F0B.{0,1000} | offensive_tool_keyword | Nidhogg | Nidhogg is an all-in-one simple to use rootkit for red teams. | T1055 - T1055.012 - T1574 - T1574.002 - T1056 - T1056.001 - T1027 - T1027.002 - T1112 - T1050 - T1106 - T1554 - T1554.002 - T1134 - T1134.001 - T1037 - T1037.001 - T1053 - T1053.005 - T1055.011 - T1098 - T1098.003 - T1070.001 - T1070.002 - T1070.003 - T1070.004 - T1070.006 - T1070.007 - T1070.008 - T1070.009 - T1083 - T1113 - T1113.001 - T1125 - T1125.001 - T1482 - T1489 - T1490 - T1497 - T1497.001 - T1497.002 - T1497.003 - T1498 - T1498.001 - T1498.002 - T1499 - T1499.001 - T1499.002 - T1499.003 - T1499.004 - T1499.005 - T1562 - T1562.001 - T1562.003 - T1562.004 - T1562.006 - T1562.007 - T1562.008 - T1562.009 - T1562.010 - T1562.011 - T1562.012 | TA0005 - TA0003 - TA0004 - TA0006 - TA0009 - TA0040 | N/A | Black Basta | Exploitation tool | https://github.com/Idov31/Nidhogg | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1946 | 284 | 2025-04-19T14:28:47Z | 2022-05-29T14:37:50Z | 22154 |
97 | *13C84182-2F5F-4EE8-A37A-4483E7E57154* | .{0,1000}13C84182\-2F5F\-4EE8\-A37A\-4483E7E57154.{0,1000} | offensive_tool_keyword | SharpExShell | SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application | T1021.003 - T1218.007 - T1127.001 | TA0008 - TA0009 - TA0005 | N/A | N/A | Lateral Movement | https://github.com/grayhatkiller/SharpExShell | 1 | 0 | #GUIDproject | N/A | 8 | 1 | 70 | 15 | 2024-05-01T23:17:25Z | 2023-10-30T18:16:41Z | 22156 |
98 | *14083A04-DD4B-4E7D-A16E-86947D3D6D74* | .{0,1000}14083A04\-DD4B\-4E7D\-A16E\-86947D3D6D74.{0,1000} | offensive_tool_keyword | Xrulez | XRulez is a Windows executable that can add malicious rules to Outlook from the command line of a compromised host. | T1078 - T1105 - T1059 - T1566 | TA0002 - TA0003 - TA0005 - TA0011 | N/A | N/A | Persistence | https://github.com/FSecureLABS/Xrulez | 1 | 0 | #GUIDproject | N/A | 10 | 2 | 162 | 45 | 2018-12-11T16:33:08Z | 2016-08-31T10:10:10Z | 22174 |
99 | *14CA405B-8BAC-48AB-9FBA-8FB5DF88FD0D* | .{0,1000}14CA405B\-8BAC\-48AB\-9FBA\-8FB5DF88FD0D.{0,1000} | offensive_tool_keyword | Malware RAT collection | from Malware RAT samples | T1105 - T1059 - T1109 - T1016 - T1071.001 - T1082 - T1027 - T1083 - T1056 - T1106 - T1078 - T1053 | TA0011 - TA0009 - TA0006 - TA0003 - TA0002 - TA0005 - TA0007 | N/A | N/A | Malware | https://github.com/x-cod3r/Remote-administration-tools-archive | 1 | 0 | #GUIDproject | N/A | 9 | 1 | 93 | 30 | 2023-10-03T15:08:22Z | 2023-10-03T13:09:00Z | 22219 |
100 | *14CA405B-8BAC-48AB-9FBA-8FB5DF88FD0D* | .{0,1000}14CA405B\-8BAC\-48AB\-9FBA\-8FB5DF88FD0D.{0,1000} | greyware_tool_keyword | Quasar | Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#. | T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125 | TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040 | N/A | Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats | RMM | https://github.com/quasar/Quasar | 1 | 0 | #GUIDproject | N/A | N/A | 10 | 9187 | 2551 | 2024-02-29T06:37:37Z | 2014-07-08T12:27:59Z | 22220 |
101 | *15ce9a3c-4609-4184-87b2-e29fc5e2b770* | .{0,1000}15ce9a3c\-4609\-4184\-87b2\-e29fc5e2b770.{0,1000} | offensive_tool_keyword | SharpZeroLogon | exploit for CVE-2020-1472 | T1210 - T1558.003 - T1078.002 - T1098 - T1003.006 | TA0001 - TA0004 - TA0005 - TA0006 - TA0003 | Ghost Ransomware | N/A | Exploitation tool | https://github.com/leitosama/SharpZeroLogon | 1 | 0 | #GUIDproject | N/A | 10 | 1 | 27 | 17 | 2021-02-13T10:13:32Z | 2021-02-13T09:44:43Z | 22285 |
102 | *1605d453-7d62-4198-a436-27e48ef828eb* | .{0,1000}1605d453\-7d62\-4198\-a436\-27e48ef828eb.{0,1000} | offensive_tool_keyword | ShimMe | Injects a DLL into a suspended process running as SYSTEM via the OfficeClickToRun service for privilege escalation - Shim Injector: Injects a DLL into a process by modifying shim data in memory without creating or registering new SDB files to evade detection. | T1055 - T1053 - T1548.002 - T1078 - T1546 - T1070 | TA0004 - TA0005 - TA0006 - TA0009 | N/A | N/A | Privilege Escalation | https://github.com/deepinstinct/ShimMe | 1 | 0 | #GUIDproject | N/A | 9 | 2 | 140 | 20 | 2024-10-29T07:33:38Z | 2024-08-04T10:03:28Z | 22292 |
103 | *1617117C-0E94-4E6A-922C-836D616EC1F5* | .{0,1000}1617117C\-0E94\-4E6A\-922C\-836D616EC1F5.{0,1000} | offensive_tool_keyword | Shellcode-Hide | simple shellcode Loader - Encoders (base64 - custom - UUID - IPv4 - MAC) - Encryptors (AES) - Fileless Loader (Winhttp socket) | T1059.003 - T1027 - T1132 - T1027.002 - T1045 - T1027.004 - T1105 | TA0005 - TA0001 - TA0003 | N/A | N/A | Defense Evasion | https://github.com/TheD1rkMtr/Shellcode-Hide | 1 | 0 | #GUIDproject | N/A | 9 | 5 | 416 | 109 | 2023-08-02T02:22:20Z | 2023-02-05T17:31:43Z | 22301 |
104 | *1659E645-27B0-4AB9-A10E-64BA4B801CB0* | .{0,1000}1659E645\-27B0\-4AB9\-A10E\-64BA4B801CB0.{0,1000} | offensive_tool_keyword | OSEP-Code-Snippets | notable code snippets for Offensive Security's PEN-300 (OSEP) course | T1116 - T1204.002 - T1027.009 - T1021.005 - T1560.001 - T1100 - T1003.001 - T1564.001 - T1047 - T1210 - T1134.002 - T1055 - T1055.011 - T1055.012 - T1204 | TA0005 - TA0040 - TA0008 - TA0003 - TA0006 - TA0004 | N/A | N/A | Exploitation tool | https://github.com/chvancooten/OSEP-Code-Snippets | 1 | 0 | #GUIDproject | N/A | 8 | 10 | 1254 | 444 | 2024-01-04T15:17:17Z | 2021-03-10T21:34:41Z | 22327 |
105 | *171A9A71-EDEF-4891-9828-44434A00585E* | .{0,1000}171A9A71\-EDEF\-4891\-9828\-44434A00585E.{0,1000} | offensive_tool_keyword | VectorKernel | PoCs for Kernelmode rootkit techniques research. | T1543 - T1055 - T1134 - T1564 - T1070 - T1057 - T1574 - T1562 - T1082 - T1518 | TA0003 - TA0005 - TA0004 - TA0008 - TA0007 | N/A | N/A | Exploitation tool | https://github.com/daem0nc0re/VectorKernel/ | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 367 | 60 | 2025-01-21T08:22:42Z | 2023-11-23T12:36:31Z | 22376 |
106 | *17332F12-D796-42D1-9A3E-460590A49382* | .{0,1000}17332F12\-D796\-42D1\-9A3E\-460590A49382.{0,1000} | offensive_tool_keyword | RedTeam_Tools_n_Stuff | Collection of self-made Red Team tools | T1070.004 - T1222 - T1070.003 - T1003.005 - T1057 | TA0005 - TA0006 - TA0007 | N/A | N/A | Exploitation tool | https://github.com/samkenxstream/SAMkenXCCorePHdLAwiN8SoLr77 | 1 | 0 | #GUIDproject | N/A | 7 | 1 | 1 | 1 | 2023-10-13T06:31:42Z | 2023-10-04T13:43:37Z | 22382 |
107 | *17589EA6-FCC9-44BB-92AD-D5B3EEA6AF03* | .{0,1000}17589EA6\-FCC9\-44BB\-92AD\-D5B3EEA6AF03.{0,1000} | offensive_tool_keyword | KeeFarce | Extracts passwords from a KeePass 2.x database directly from memory | T1003 - T1055 - T1059 | TA0006 | N/A | N/A | Credential Access | https://github.com/denandz/KeeFarce | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1009 | 132 | 2015-11-17T04:12:25Z | 2015-10-27T05:29:04Z | 22390 |
108 | *17FC11E9-C258-4B8D-8D07-2F4125156244* | .{0,1000}17FC11E9\-C258\-4B8D\-8D07\-2F4125156244.{0,1000} | offensive_tool_keyword | mimikatz | mimikatz UUID | T1134.005 - T1098 - T1547.005 - T1555 - T1555.003 - T1555.004 - T1003.001 - T1003.002 - T1003.004 - T1003.006 - T1207 - T1649 - T1558.001 - T1558.002 - T1552.004 - T1550.002 - T1550.003 | TA0004 - TA0006 - TA0003 - TA0008 - TA0009 | N/A | Black Basta - APT1 - APT24 - APT28 - APT29 - APT32 - APT33 - APT38 - APT39 - APT41 - APT5 - Akira - Avivore - BERSERK BEAR - BOSS SPIDER - BRONZE BUTLER - BackdoorDiplomacy - Blue Mockingbird - CHRYSENE - COZY BEAR - Carbanak - Chamelgang - Chimera - Cleaver - Cobalt Group - DarkHydrus - Dragonfly - Earth Lusca - FANCY BEAR - FIN13 - FIN6 - FIN7 - GALLIUM - Gamaredon - HEXANE - Indrik Spider - Ke3chang - Kimsuky - LAPSUS$ - Leafminer - Magic Hound - MuddyWater - OilRig - PittyTiger - Sandworm Team - Scattered Spider - TA505 - TEMP.Veles - Threat Group-3390 - Thrip - Tonto Team - Turla - Unit 29155 - Volt Typhoon - Whitefly - Wizard Spider - menuPass - Dispossessor - DragonForce - Sphinx | Credential Access | https://github.com/gentilkiwi/mimikatz | 1 | 0 | #GUIDproject | uuid | 10 | 10 | 20094 | 3854 | 2024-07-05T17:42:58Z | 2014-04-06T18:30:02Z | 22428 |
109 | *1824ED63-BE4D-4306-919D-9C749C1AE271* | .{0,1000}1824ED63\-BE4D\-4306\-919D\-9C749C1AE271.{0,1000} | offensive_tool_keyword | SharpDecryptPwd | Decrypt Navicat,Xmanager,Filezilla,Foxmail,WinSCP,etc | T1003.008 - T1555.004 - T1552.002 | TA0006 | N/A | N/A | Credential Access | https://github.com/RowTeam/SharpDecryptPwd | 1 | 0 | #GUIDproject | N/A | 10 | 8 | 769 | 117 | 2022-03-04T02:49:31Z | 2022-02-25T11:21:43Z | 22436 |
110 | *189219A1-9A2A-4B09-8F69-6207E9996F94* | .{0,1000}189219A1\-9A2A\-4B09\-8F69\-6207E9996F94.{0,1000} | offensive_tool_keyword | OSEP-Code-Snippets | notable code snippets for Offensive Security's PEN-300 (OSEP) course | T1116 - T1204.002 - T1027.009 - T1021.005 - T1560.001 - T1100 - T1003.001 - T1564.001 - T1047 - T1210 - T1134.002 - T1055 - T1055.011 - T1055.012 - T1204 | TA0005 - TA0040 - TA0008 - TA0003 - TA0006 - TA0004 | N/A | N/A | Exploitation tool | https://github.com/chvancooten/OSEP-Code-Snippets | 1 | 0 | #GUIDproject | N/A | 8 | 10 | 1254 | 444 | 2024-01-04T15:17:17Z | 2021-03-10T21:34:41Z | 22467 |
111 | *18A66118-B98D-4FFC-AABE-DAFF5779F14C* | .{0,1000}18A66118\-B98D\-4FFC\-AABE\-DAFF5779F14C.{0,1000} | offensive_tool_keyword | Invisi-Shell | Hide your powershell script in plain sight! Invisi-Shell bypasses all of Powershell security features (ScriptBlock logging. Module logging. Transcription. AMSI) by hooking .Net assemblies. The hook is performed via CLR Profiler API. | T1027 - T1059.001 - T1562 | TA0005 - TA0002 | N/A | N/A | Defense Evasion | https://github.com/OmerYa/Invisi-Shell | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1167 | 166 | 2019-08-19T19:55:19Z | 2018-10-14T23:32:56Z | 22474 |
112 | *18C681A2-072F-49D5-9DE6-74C979EAE08B* | .{0,1000}18C681A2\-072F\-49D5\-9DE6\-74C979EAE08B.{0,1000} | offensive_tool_keyword | ForkPlayground | proof-of-concept of Process Forking. | T1055 - T1003 | TA0001 - TA0005 | N/A | N/A | Defense Evasion | https://github.com/D4stiny/ForkPlayground | 1 | 0 | #GUIDproject | N/A | 7 | 3 | 226 | 33 | 2021-11-29T21:42:43Z | 2021-11-26T04:21:46Z | 22482 |
113 | *190DFAEB-0288-4043-BE0E-3273FA653B52* | .{0,1000}190DFAEB\-0288\-4043\-BE0E\-3273FA653B52.{0,1000} | offensive_tool_keyword | PredatorTheStealer | C++ stealer (passwords - cookies - forms - cards - wallets) | T1078 - T1114 - T1555 - T1539 - T1212 - T1132 | TA0006 - TA0010 | N/A | N/A | Credential Access | https://github.com/SecUser1/PredatorTheStealer | 1 | 0 | #GUIDproject | N/A | 8 | 1 | 11 | 2 | 2022-12-06T16:46:33Z | 2022-12-06T16:34:43Z | 22499 |
114 | *196B8469-F798-4ECC-9A77-C1CAB5BF6EAE* | .{0,1000}196B8469\-F798\-4ECC\-9A77\-C1CAB5BF6EAE.{0,1000} | offensive_tool_keyword | HardHatC2 | A C# Command & Control framework | T1105 - T1573 - T1071 - T1027 | TA0011 - TA0005 - TA0010 | N/A | N/A | C2 | https://github.com/DragoQCC/HardHatC2 | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 996 | 130 | 2024-03-28T02:30:02Z | 2022-12-08T19:40:47Z | 22526 |
115 | *1a3c4069-8c11-4336-bef8-9a43c0ba60e2* | .{0,1000}1a3c4069\-8c11\-4336\-bef8\-9a43c0ba60e2.{0,1000} | offensive_tool_keyword | DomainPasswordSpray | DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. | T1110.001 - T1110.003 | TA0001 - TA0006 | N/A | N/A | Credential Access | https://github.com/dafthack/DomainPasswordSpray | 1 | 0 | #GUIDproject | module id | 10 | 10 | 1865 | 388 | 2024-07-11T18:18:57Z | 2016-10-04T23:37:37Z | 22585 |
116 | *1A8C9BD8-1800-46B0-8E22-7D3823C68366* | .{0,1000}1A8C9BD8\-1800\-46B0\-8E22\-7D3823C68366.{0,1000} | offensive_tool_keyword | SharpGhostTask | registry manipulation to create scheduled tasks without triggering the usual event logs. | T1053.005 - T1112 - T1564.001 | TA0003 - TA0005 | N/A | N/A | Defense Evasion | https://github.com/dmcxblue/SharpGhostTask | 1 | 0 | #GUIDproject | N/A | 10 | 2 | 114 | 12 | 2024-01-05T15:42:55Z | 2024-01-04T21:42:33Z | 22611 |
117 | *1A99EBED-6E53-469F-88B7-F4C3D2C96B07* | .{0,1000}1A99EBED\-6E53\-469F\-88B7\-F4C3D2C96B07.{0,1000} | offensive_tool_keyword | AppProxyC2 | simple POC to show how to tunnel traffic through Azure Application Proxy | T1090 - T1572 - T1071 | TA0005 - TA0008 - TA0011 | N/A | N/A | C2 | https://github.com/xpn/AppProxyC2 | 1 | 0 | #GUIDProject | N/A | 9 | 10 | 69 | 18 | 2021-04-21T13:02:15Z | 2021-04-21T10:46:16Z | 22613 |
118 | *1AFD1BA3-028A-4E0F-82A8-095F38694ECF* | .{0,1000}1AFD1BA3\-028A\-4E0F\-82A8\-095F38694ECF.{0,1000} | offensive_tool_keyword | Thread-Pool-Injection-PoC | Proof of concept code for thread pool based process injection in Windows. | T1055.011 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/Uri3n/Thread-Pool-Injection-PoC | 1 | 0 | #GUIDproject | N/A | 8 | 2 | 115 | 13 | 2025-03-29T23:14:47Z | 2024-01-24T07:42:08Z | 22651 |
119 | *1B1F64B3-B8A4-4BBB-BB66-F020E2D4F288* | .{0,1000}1B1F64B3\-B8A4\-4BBB\-BB66\-F020E2D4F288.{0,1000} | offensive_tool_keyword | Perfusion | Exploit for the RpcEptMapper registry key permissions vulnerability (Windows 7 / 2088R2 / 8 / 2012) | T1068 - T1055 - T1548.002 | TA0003 - TA0004 - TA0005 | N/A | N/A | Privilege Escalation | https://github.com/itm4n/Perfusion | 1 | 0 | #GUIDproject | N/A | 10 | 5 | 419 | 75 | 2021-04-22T16:20:32Z | 2021-02-11T18:28:22Z | 22659 |
120 | *1B3C96A3-F698-472B-B786-6FED7A205159* | .{0,1000}1B3C96A3\-F698\-472B\-B786\-6FED7A205159.{0,1000} | offensive_tool_keyword | localpotato | The LocalPotato attack is a type of NTLM reflection attack that targets local authentication. This attack allows for arbitrary file read/write and elevation of privilege. | T1550.002 - T1078.003 - T1005 - T1070.004 | TA0004 - TA0006 - TA0002 | N/A | N/A | Privilege Escalation | https://github.com/decoder-it/LocalPotato | 1 | 0 | #GUIDproject | N/A | 10 | 7 | 691 | 92 | 2023-11-07T01:09:08Z | 2023-01-04T18:22:29Z | 22668 |
121 | *1B454840-E496-4F27-AA18-439A4E97BCC6* | .{0,1000}1B454840\-E496\-4F27\-AA18\-439A4E97BCC6.{0,1000} | offensive_tool_keyword | Carbanak | remote backdoor used by a group of the same name (Carbanak). It is intended for espionage - data exfiltration and providing remote access to infected machines | T1021.002 - T1071.001 - T1105 - T1059 - T1003 - T1078 - T1041 | TA0006 - TA0008 - TA0010 - TA0011 | Carbanak | FIN7 - Carbanak | Malware | https://github.com/0x25bit/Updated-Carbanak-Source-with-Plugins | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 396 | 223 | 2019-05-01T23:31:35Z | 2019-04-22T21:01:08Z | 22672 |
122 | *1B52A3D9-014C-4CBF-BB98-09080D9A8D16* | .{0,1000}1B52A3D9\-014C\-4CBF\-BB98\-09080D9A8D16.{0,1000} | offensive_tool_keyword | ConfuserEx | ConfuserEx is a widely used open source obfuscator often found in malware | T1027 - T1045 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/yck1509/ConfuserEx | 1 | 0 | #GUIDproject | N/A | 6 | 10 | 3629 | 1661 | 2019-05-14T14:23:56Z | 2014-03-28T07:00:26Z | 22678 |
123 | *1BA54A13-B390-47B3-9628-B58A2BBA193B* | .{0,1000}1BA54A13\-B390\-47B3\-9628\-B58A2BBA193B.{0,1000} | offensive_tool_keyword | r77-rootkit | Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections | T1014 - T1055 - T1055.013 - T1060 - T1106 - T1070.009 | TA0005 - TA0003 | N/A | N/A | Persistence | https://github.com/bytecode77/r77-rootkit | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1884 | 425 | 2025-03-25T17:59:20Z | 2017-12-17T13:04:14Z | 22703 |
124 | *1BACEDDC-CD87-41DC-948C-1C12F960BECB* | .{0,1000}1BACEDDC\-CD87\-41DC\-948C\-1C12F960BECB.{0,1000} | offensive_tool_keyword | themebleed | Proof-of-Concept for CVE-2023-38146 | T1566.001 - T1077 - T1213.002 | TA0007 - TA0011 - TA0010 | N/A | N/A | Exploitation tool | https://github.com/gabe-k/themebleed | 1 | 0 | #GUIDproject | N/A | 10 | 2 | 196 | 37 | 2023-09-13T04:50:29Z | 2023-09-13T04:00:14Z | 22706 |
125 | *1BF9C10F-6F89-4520-9D2E-AAF17D17BA5E* | .{0,1000}1BF9C10F\-6F89\-4520\-9D2E\-AAF17D17BA5E.{0,1000} | offensive_tool_keyword | SweetPotato | Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019 | T1548 - T1055 | TA0004 - TA0005 | N/A | N/A | Privilege Escalation | https://github.com/CCob/SweetPotato | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1697 | 228 | 2024-09-04T17:09:30Z | 2020-04-12T17:40:03Z | 22721 |
126 | *1c50adeb-53ac-41b9-9c34-7045cffbae45* | .{0,1000}1c50adeb\-53ac\-41b9\-9c34\-7045cffbae45.{0,1000} | offensive_tool_keyword | o365enum | Enumerate valid usernames from Office 365 using ActiveSync - Autodiscover v1 or office.com login page. | T1595 - T1595.002 - T1114 - T1114.001 - T1087 - T1087.002 | TA0040 - TA0010 - TA0007 | N/A | N/A | Exploitation tool | https://github.com/gremwell/o365enum | 1 | 0 | #GUIDproject | N/A | 7 | 3 | 267 | 39 | 2024-05-02T07:45:31Z | 2020-02-18T12:22:50Z | 22742 |
127 | *1C5EDA8C-D27F-44A4-A156-6F863477194D* | .{0,1000}1C5EDA8C\-D27F\-44A4\-A156\-6F863477194D.{0,1000} | offensive_tool_keyword | ntdlll-unhooking-collection | unhooking ntdll from disk - from KnownDlls - from suspended process - from remote server (fileless) | T1055 - T1055.001 - T1070 - T1070.004 - T1101 - T1574 - T1574.002 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/TheD1rkMtr/ntdlll-unhooking-collection | 1 | 0 | #GUIDproject | N/A | 9 | 2 | 188 | 38 | 2023-08-02T02:26:33Z | 2023-02-07T16:54:15Z | 22747 |
128 | *1CC6E8A9-1875-430C-B2BB-F227ACD711B1* | .{0,1000}1CC6E8A9\-1875\-430C\-B2BB\-F227ACD711B1.{0,1000} | greyware_tool_keyword | shadowsocks | shadowsocks is a fast tunnel proxy that helps you bypass firewalls | T1572 - T1090 | TA0011 - TA0005 | N/A | N/A | C2 | https://github.com/shadowsocks/shadowsocks-windows | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 58770 | 16368 | 2025-01-01T08:09:55Z | 2013-01-14T07:54:16Z | 22780 |
129 | *1D1B59D9-10AF-40FE-BE99-578C09DB7A2A* | .{0,1000}1D1B59D9\-10AF\-40FE\-BE99\-578C09DB7A2A.{0,1000} | offensive_tool_keyword | ShareAudit | A tool for auditing network shares in an Active Directory environment | T1135 - T1005 - T1083 - T1210 | TA0007 - TA0009 | N/A | N/A | Discovery | https://github.com/dionach/ShareAudit | 1 | 0 | #GUIDproject | N/A | 8 | 1 | 42 | 15 | 2019-04-29T10:07:57Z | 2019-02-26T16:00:15Z | 22797 |
130 | *1DFC488D-E104-4F35-98DA-F23BF6D3F9DC* | .{0,1000}1DFC488D\-E104\-4F35\-98DA\-F23BF6D3F9DC.{0,1000} | offensive_tool_keyword | ShareAudit | A tool for auditing network shares in an Active Directory environment | T1135 - T1005 - T1083 - T1210 | TA0007 - TA0009 | N/A | N/A | Discovery | https://github.com/dionach/ShareAudit | 1 | 0 | #GUIDproject | N/A | 8 | 1 | 42 | 15 | 2019-04-29T10:07:57Z | 2019-02-26T16:00:15Z | 22867 |
131 | *1E0986B4-4BF3-4CEA-A885-347B6D232D46* | .{0,1000}1E0986B4\-4BF3\-4CEA\-A885\-347B6D232D46.{0,1000} | offensive_tool_keyword | SharpLAPS | Retrieve LAPS password from LDAP | T1552.005 - T1212 | TA0006 - TA0007 | N/A | Dispossessor | Credential Access | https://github.com/swisskyrepo/SharpLAPS | 1 | 0 | #GUIDproject | N/A | 10 | 5 | 408 | 85 | 2021-02-17T14:32:16Z | 2021-02-16T17:27:41Z | 22872 |
132 | *1e1f0cff-ff7a-406d-bd82-e53809a5e93a* | .{0,1000}1e1f0cff\-ff7a\-406d\-bd82\-e53809a5e93a.{0,1000} | offensive_tool_keyword | VenomousSway | VBA payload generation framework | T1059.005 | TA0002 - TA0005 | N/A | N/A | Defense Evasion | https://github.com/trustedsec/The_Shelf | 1 | 0 | #GUIDproject | The GUID of the VSTO's security public key | 10 | 3 | 247 | 14 | 2024-11-25T19:33:34Z | 2024-05-22T14:31:52Z | 22878 |
133 | *1E2A1E78-ED0B-414B-A956-86232B1025BE* | .{0,1000}1E2A1E78\-ED0B\-414B\-A956\-86232B1025BE.{0,1000} | offensive_tool_keyword | Lime-RAT | remote administration tool for Windows (RAT) | T1059 - T1573.001 - T1027 - T1091 - T1486 - T1036 - T1560 - T1566 - T1480 - T1498 - T1113 - T1083 - T1016 - T1105 - T1056 - T1021 - T1112 - T1082 - T1072 - T1076 - T1078 - T1209 - T1003 - T1012 - T1100 - T1135 - T1108 - T1029 - T1547 - T1053 - T1060 - T1102 - T1124 - T1049 - T1123 - T1145 - T1210 - T1046 - T1010 - T1055 | TA0040 - TA0010 - TA0005 - TA0011 - TA0043 - TA0006 - TA0042 - TA0008 - TA0009 - TA0007 - TA0002 - TA0003 | N/A | APT-C-36 - Operation Comando | Malware | https://github.com/NYAN-x-CAT/Lime-RAT | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1086 | 413 | 2019-06-24T17:05:48Z | 2018-02-07T15:35:56Z | 22881 |
134 | *1E474090-96A7-433C-BFE6-0F8B45DECC42* | .{0,1000}1E474090\-96A7\-433C\-BFE6\-0F8B45DECC42.{0,1000} | offensive_tool_keyword | SharpFtpC2 | A Streamlined FTP-Driven Command and Control Conduit for Interconnecting Remote Systems | T1071.002 - T1105 - T1090.001 | TA0011 | N/A | N/A | C2 | https://github.com/PhrozenIO/SharpFtpC2 | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 88 | 15 | 2023-11-09T10:37:20Z | 2023-06-09T12:41:28Z | 22887 |
135 | *1E70D62D-CC36-480F-82BB-E9593A759AF9* | .{0,1000}1E70D62D\-CC36\-480F\-82BB\-E9593A759AF9.{0,1000} | offensive_tool_keyword | PowerShx | Run Powershell without software restrictions. | T1059.001 - T1055.001 - T1055.012 | TA0002 - TA0005 | N/A | N/A | Defense Evasion | https://github.com/iomoath/PowerShx | 1 | 0 | #GUIDproject | N/A | 7 | 3 | 286 | 47 | 2021-09-08T03:44:10Z | 2021-09-06T18:32:45Z | 22902 |
136 | *1eb987e0-23a5-415e-9194-cd961314441b* | .{0,1000}1eb987e0\-23a5\-415e\-9194\-cd961314441b.{0,1000} | offensive_tool_keyword | PrivFu | SeTcbPrivilege exploitation | T1134 - T1134.001 - T1078 - T1059 - T1075 | TA0004 | N/A | N/A | Privilege Escalation | https://github.com/daem0nc0re/PrivFu/ | 1 | 0 | #GUIDproject | PrivFu\PowerOfTcb | 10 | 9 | 849 | 122 | 2025-01-21T05:22:50Z | 2021-12-28T13:14:25Z | 22926 |
137 | *1fc325f3-c548-43db-a13f-8c460dda8381* | .{0,1000}1fc325f3\-c548\-43db\-a13f\-8c460dda8381.{0,1000} | offensive_tool_keyword | DNS-Tunnel-Keylogger | Keylogging server and client that uses DNS tunneling/exfiltration to transmit keystrokes | T1056.001 - T1048.003 | TA0009 - TA0011 | N/A | N/A | Collection | https://github.com/Geeoon/DNS-Tunnel-Keylogger | 1 | 0 | #GUIDproject | N/A | 9 | 3 | 273 | 40 | 2024-06-16T19:47:36Z | 2024-01-10T17:25:58Z | 23002 |
138 | *1FDCAD33-E5D1-4D5F-ACD5-FA6F8661DFE5* | .{0,1000}1FDCAD33\-E5D1\-4D5F\-ACD5\-FA6F8661DFE5.{0,1000} | offensive_tool_keyword | Accomplice | Tools for discovery and abuse of COM hijacks | T1120 - T1174 | TA0007 - TA0003 | N/A | N/A | Discovery | https://github.com/nccgroup/Accomplice | 1 | 0 | #GUIDproject | N/A | 7 | 4 | 303 | 47 | 2019-10-15T21:54:09Z | 2019-09-04T23:32:09Z | 23010 |
139 | *20B3AA84-9CA7-43E5-B0CD-8DBA5091DF92* | .{0,1000}20B3AA84\-9CA7\-43E5\-B0CD\-8DBA5091DF92.{0,1000} | offensive_tool_keyword | SharpRDPThief | A C# implementation of RDPThief to steal credentials from RDP | T1056.004 - T1110 - T1563.002 | TA0006 - TA0043 | N/A | N/A | Credential Access | https://github.com/passthehashbrowns/SharpRDPThief | 1 | 0 | #GUIDproject | N/A | 10 | 2 | 160 | 28 | 2020-08-28T03:48:51Z | 2020-08-26T22:27:36Z | 23084 |
140 | *210A3DB2-11E3-4BB4-BE7D-554935DCCA43* | .{0,1000}210A3DB2\-11E3\-4BB4\-BE7D\-554935DCCA43.{0,1000} | offensive_tool_keyword | UACME | Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor. | T1548 - T1547 - T1218 | TA0002 - TA0005 - TA0004 | N/A | Evilnum | Defense Evasion | https://github.com/hfiref0x/UACME | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 6711 | 1348 | 2025-03-09T03:33:26Z | 2015-03-28T12:04:33Z | 23104 |
141 | *2116E6C5-F609-4CA8-B1A1-E87B7BE770A4* | .{0,1000}2116E6C5\-F609\-4CA8\-B1A1\-E87B7BE770A4.{0,1000} | offensive_tool_keyword | PassTheChallenge | Recovering NTLM hashes from Credential Guard | T1003 - T1555.002 | TA0006 - TA0005 | N/A | N/A | Exploitation tool | https://github.com/ly4k/PassTheChallenge | 1 | 0 | #GUIDproject | N/A | 9 | 4 | 334 | 21 | 2022-12-26T01:09:18Z | 2022-12-26T00:56:40Z | 23107 |
142 | *211A4598-B46E-4CD3-BA5A-1EC259D4DB5A* | .{0,1000}211A4598\-B46E\-4CD3\-BA5A\-1EC259D4DB5A.{0,1000} | offensive_tool_keyword | ConfuserEx | ConfuserEx is a widely used open source obfuscator often found in malware | T1027 - T1045 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/yck1509/ConfuserEx | 1 | 0 | #GUIDproject | N/A | 6 | 10 | 3629 | 1661 | 2019-05-14T14:23:56Z | 2014-03-28T07:00:26Z | 23109 |
143 | *2150D252-AA17-45C2-8981-A6DCF7055CA6* | .{0,1000}2150D252\-AA17\-45C2\-8981\-A6DCF7055CA6.{0,1000} | offensive_tool_keyword | Koppeling | Adaptive DLL hijacking / dynamic export forwarding | T1574.002 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/monoxgas/Koppeling | 1 | 0 | #GUIDproject | N/A | 8 | 8 | 748 | 128 | 2020-07-06T14:47:57Z | 2020-02-18T21:08:16Z | 23123 |
144 | *2164E6D9-6023-4932-A08F-7A5C15E2CA0B* | .{0,1000}2164E6D9\-6023\-4932\-A08F\-7A5C15E2CA0B.{0,1000} | offensive_tool_keyword | shutter | The goal of Shutter is to manage windows network stack communication via Windows Filtering Platform. Management can include blocking or permiting traffic based on IP or an executable that initiates or receives the traffic. | T1562 - T1027 | TA0005 - TA0007 | N/A | N/A | Defense Evasion | https://github.com/dsnezhkov/shutter | 1 | 0 | #GUIDproject | N/A | 10 | 2 | 116 | 15 | 2021-05-12T19:05:14Z | 2021-05-12T18:51:03Z | 23133 |
145 | *22020898-6F0D-4D71-B14D-CB5897C5A6AA* | .{0,1000}22020898\-6F0D\-4D71\-B14D\-CB5897C5A6AA.{0,1000} | offensive_tool_keyword | CreateService | Creating a persistent service | T1543.003 - T1547.001 - T1050 | TA0003 | N/A | N/A | Persistence | https://github.com/uknowsec/CreateService | 1 | 0 | #GUIDproject | N/A | 4 | 2 | 105 | 27 | 2021-04-26T06:43:12Z | 2020-09-23T05:03:52Z | 23172 |
146 | *227c72ed-494a-4d29-9170-5e5994c12f5c* | .{0,1000}227c72ed\-494a\-4d29\-9170\-5e5994c12f5c.{0,1000} | offensive_tool_keyword | POC | Windows Privilege escalation POC exploitation for CVE-2024-49138 | T1068 - T1058 - T1203 | TA0004 | N/A | N/A | Privilege Escalation | https://github.com/emdnaia/CVE-2024-49138-POC | 1 | 0 | #GUIDproject | N/A | 9 | 1 | 1 | 0 | 2025-01-15T01:01:21Z | 2025-01-15T02:11:49Z | 23218 |
147 | *2297A528-E866-4056-814A-D01C1C305A38* | .{0,1000}2297A528\-E866\-4056\-814A\-D01C1C305A38.{0,1000} | offensive_tool_keyword | PrivFu | PoCs for sensitive token privileges such SeDebugPrivilege | T1068 - T1134 - T1134.001 - T1078 - T1059 | TA0004 - TA0009 - TA0003 | N/A | N/A | Privilege Escalation | https://github.com/daem0nc0re/PrivFu | 1 | 0 | #GUIDproject | PrivilegedOperations | 10 | 9 | 849 | 122 | 2025-01-21T05:22:50Z | 2021-12-28T13:14:25Z | 23224 |
148 | *22A156EA-2623-45C7-8E50-E864D9FC44D3* | .{0,1000}22A156EA\-2623\-45C7\-8E50\-E864D9FC44D3.{0,1000} | offensive_tool_keyword | SharpPack | collection of C# tools that include functionalities like Kerberoasting - ticket manipulation - Mimikatz - privilege escalation - domain enumeration and more | T1558.003 - T1003 - T1059.004 - T1078 - T1212 - T1087 - T1016 - T1071 - T1555 - T1203 | TA0003 - TA0004 - TA0006 - TA0008 - TA0009 - TA0011 | N/A | N/A | Exploitation tool | https://github.com/Lexus89/SharpPack | 1 | 0 | #GUIDproject | N/A | 10 | 1 | 78 | 19 | 2019-08-12T13:25:25Z | 2018-10-01T12:45:16Z | 23228 |
149 | *22A156EA-2623-45C7-8E50-E864D9FC44D3* | .{0,1000}22A156EA\-2623\-45C7\-8E50\-E864D9FC44D3.{0,1000} | offensive_tool_keyword | SharpView | C# implementation of harmj0y's PowerView | T1018 - T1482 - T1087.002 - T1069.002 | TA0007 - TA0003 - TA0001 | N/A | Conti - APT29 | Discovery | https://github.com/tevora-threat/SharpView/ | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1032 | 196 | 2024-03-22T16:34:09Z | 2018-07-24T21:15:04Z | 23229 |
150 | *23975ac9-f51c-443a-8318-db006fd83100* | .{0,1000}23975ac9\-f51c\-443a\-8318\-db006fd83100.{0,1000} | offensive_tool_keyword | o365enum | Enumerate valid usernames from Office 365 using ActiveSync - Autodiscover v1 or office.com login page. | T1595 - T1595.002 - T1114 - T1114.001 - T1087 - T1087.002 | TA0040 - TA0010 - TA0007 | N/A | N/A | Exploitation tool | https://github.com/gremwell/o365enum | 1 | 0 | #GUIDproject | N/A | 7 | 3 | 267 | 39 | 2024-05-02T07:45:31Z | 2020-02-18T12:22:50Z | 23291 |
151 | *23A2E629-DC9D-46EA-8B5A-F1D60566EA09* | .{0,1000}23A2E629\-DC9D\-46EA\-8B5A\-F1D60566EA09.{0,1000} | offensive_tool_keyword | UACME | Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor. | T1548 - T1547 - T1218 | TA0002 - TA0005 - TA0004 | N/A | Evilnum | Defense Evasion | https://github.com/hfiref0x/UACME | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 6711 | 1348 | 2025-03-09T03:33:26Z | 2015-03-28T12:04:33Z | 23296 |
152 | *2419CEDC-BF3A-4D8D-98F7-6403415BEEA4* | .{0,1000}2419CEDC\-BF3A\-4D8D\-98F7\-6403415BEEA4.{0,1000} | offensive_tool_keyword | PipeViewer | A tool that shows detailed information about named pipes in Windows | T1022.002 - T1056.002 | TA0005 - TA0009 | N/A | N/A | discovery | https://github.com/cyberark/PipeViewer | 1 | 0 | #GUIDproject | N/A | 5 | 7 | 620 | 55 | 2024-11-15T09:55:35Z | 2022-12-22T12:35:34Z | 23330 |
153 | *253e716a-ab96-4f87-88c7-052231ec2a12* | .{0,1000}253e716a\-ab96\-4f87\-88c7\-052231ec2a12.{0,1000} | offensive_tool_keyword | DCSyncer | Perform DCSync operation | T1003.006 | TA0006 - TA0004 | N/A | N/A | Credential Access | https://github.com/notsoshant/DCSyncer | 1 | 0 | #GUIDproject | N/A | 10 | 2 | 143 | 22 | 2024-11-05T20:03:27Z | 2020-06-06T17:20:22Z | 23402 |
154 | *261f880e-4bee-428d-9f64-c29292002c19* | .{0,1000}261f880e\-4bee\-428d\-9f64\-c29292002c19.{0,1000} | offensive_tool_keyword | JuicyPotatoNG | Another Windows Local Privilege Escalation from Service Account to System | T1055.002 - T1078.003 - T1070.004 | TA0005 - TA0004 - TA0002 | N/A | FoxKitten - APT33 - Volatile Cedar - Sandworm | Privilege Escalation | https://github.com/antonioCoco/JuicyPotatoNG | 1 | 0 | #GUIDproject | N/A | 10 | 9 | 844 | 101 | 2022-11-12T01:48:39Z | 2022-09-21T17:08:35Z | 23467 |
155 | *2661F29C-69F5-4010-9198-A418C061DD7C* | .{0,1000}2661F29C\-69F5\-4010\-9198\-A418C061DD7C.{0,1000} | offensive_tool_keyword | Xrulez | XRulez is a Windows executable that can add malicious rules to Outlook from the command line of a compromised host. | T1078 - T1105 - T1059 - T1566 | TA0002 - TA0003 - TA0005 - TA0011 | N/A | N/A | Persistence | https://github.com/FSecureLABS/Xrulez | 1 | 0 | #GUIDproject | N/A | 10 | 2 | 162 | 45 | 2018-12-11T16:33:08Z | 2016-08-31T10:10:10Z | 23481 |
156 | *274F19EC-7CBA-4FC7-80E6-BB41C1FE6728* | .{0,1000}274F19EC\-7CBA\-4FC7\-80E6\-BB41C1FE6728.{0,1000} | offensive_tool_keyword | DragonCastle | A PoC that combines AutodialDLL Lateral Movement technique and SSP to scrape NTLM hashes from LSASS process. | T1003 - T1547.005 - T1055 - T1557 | TA0008 - TA0006 | N/A | N/A | Credential Access | https://github.com/mdsecactivebreach/DragonCastle | 1 | 0 | #GUIDproject | N/A | 10 | 3 | 298 | 38 | 2022-10-26T10:19:55Z | 2022-10-26T10:18:37Z | 23556 |
157 | *27CF1AE0-5FDE-4B31-A4DA-6FAD1D77351D* | .{0,1000}27CF1AE0\-5FDE\-4B31\-A4DA\-6FAD1D77351D.{0,1000} | offensive_tool_keyword | Lime-RAT | remote administration tool for Windows (RAT) | T1059 - T1573.001 - T1027 - T1091 - T1486 - T1036 - T1560 - T1566 - T1480 - T1498 - T1113 - T1083 - T1016 - T1105 - T1056 - T1021 - T1112 - T1082 - T1072 - T1076 - T1078 - T1209 - T1003 - T1012 - T1100 - T1135 - T1108 - T1029 - T1547 - T1053 - T1060 - T1102 - T1124 - T1049 - T1123 - T1145 - T1210 - T1046 - T1010 - T1055 | TA0040 - TA0010 - TA0005 - TA0011 - TA0043 - TA0006 - TA0042 - TA0008 - TA0009 - TA0007 - TA0002 - TA0003 | N/A | APT-C-36 - Operation Comando | Malware | https://github.com/NYAN-x-CAT/Lime-RAT | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1086 | 413 | 2019-06-24T17:05:48Z | 2018-02-07T15:35:56Z | 23583 |
158 | *27E42E24-9F76-44E2-B1D6-82F68D5C4466* | .{0,1000}27E42E24\-9F76\-44E2\-B1D6\-82F68D5C4466.{0,1000} | offensive_tool_keyword | POC | Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled. | T1055.011 - T1548.002 | TA0004 - TA0005 | N/A | N/A | Privilege Escalation | https://github.com/hakaioffsec/CVE-2024-21338 | 1 | 0 | #GUIDproject | N/A | 9 | 3 | 292 | 60 | 2024-04-16T21:00:14Z | 2024-04-13T05:53:02Z | 23589 |
159 | *27F85701-FD37-4D18-A107-20E914F8E779* | .{0,1000}27F85701\-FD37\-4D18\-A107\-20E914F8E779.{0,1000} | offensive_tool_keyword | SharpEventPersist | Persistence by writing/reading shellcode from Event Log | T1055 - T1070.001 - T1547.001 | TA0003 - TA0005 | N/A | N/A | Persistence | https://github.com/improsec/SharpEventPersist | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 371 | 50 | 2022-05-27T14:52:02Z | 2022-05-20T14:52:56Z | 23598 |
160 | *28CF3837-FF58-463B-AF81-E6B0039DE55F* | .{0,1000}28CF3837\-FF58\-463B\-AF81\-E6B0039DE55F.{0,1000} | offensive_tool_keyword | ShareAudit | A tool for auditing network shares in an Active Directory environment | T1135 - T1005 - T1083 - T1210 | TA0007 - TA0009 | N/A | N/A | Discovery | https://github.com/dionach/ShareAudit | 1 | 0 | #GUIDproject | N/A | 8 | 1 | 42 | 15 | 2019-04-29T10:07:57Z | 2019-02-26T16:00:15Z | 23647 |
161 | *28F9E001-67E0-4200-B120-3021596689E9* | .{0,1000}28F9E001\-67E0\-4200\-B120\-3021596689E9.{0,1000} | offensive_tool_keyword | VectorKernel | PoCs for Kernelmode rootkit techniques research. | T1543 - T1055 - T1134 - T1564 - T1070 - T1057 - T1574 - T1562 - T1082 - T1518 | TA0003 - TA0005 - TA0004 - TA0008 - TA0007 | N/A | N/A | Exploitation tool | https://github.com/daem0nc0re/VectorKernel/ | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 367 | 60 | 2025-01-21T08:22:42Z | 2023-11-23T12:36:31Z | 23657 |
162 | *29021B28-61F9-492D-BB51-7CA8889087E5* | .{0,1000}29021B28\-61F9\-492D\-BB51\-7CA8889087E5.{0,1000} | offensive_tool_keyword | DitExplorer | Tool for viewing NTDS.dit | T1003.003 | TA0006 | N/A | N/A | Credential Access | https://github.com/trustedsec/DitExplorer | 1 | 0 | #GUIDProject | N/A | 10 | 2 | 155 | 13 | 2025-03-14T13:02:44Z | 2025-02-12T15:54:04Z | 23660 |
163 | *29390239-C06E-4F26-B5A3-594A08D8D30C* | .{0,1000}29390239\-C06E\-4F26\-B5A3\-594A08D8D30C.{0,1000} | offensive_tool_keyword | Carbanak | remote backdoor used by a group of the same name (Carbanak). It is intended for espionage - data exfiltration and providing remote access to infected machines | T1021.002 - T1071.001 - T1105 - T1059 - T1003 - T1078 - T1041 | TA0006 - TA0008 - TA0010 - TA0011 | Carbanak | FIN7 - Carbanak | Malware | https://github.com/0x25bit/Updated-Carbanak-Source-with-Plugins | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 396 | 223 | 2019-05-01T23:31:35Z | 2019-04-22T21:01:08Z | 23678 |
164 | *29446C11-A1A5-47F6-B418-0D699C6C3339* | .{0,1000}29446C11\-A1A5\-47F6\-B418\-0D699C6C3339.{0,1000} | offensive_tool_keyword | GithubC2 | Github as C2 | T1095 - T1071.001 | TA0011 | N/A | N/A | C2 | https://github.com/TheD1rkMtr/GithubC2 | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 136 | 37 | 2023-08-02T02:26:05Z | 2023-02-15T00:50:59Z | 23681 |
165 | *2944dbfc-8a1e-4759-a8a2-e4568950601d* | .{0,1000}2944dbfc\-8a1e\-4759\-a8a2\-e4568950601d.{0,1000} | offensive_tool_keyword | o365enum | Enumerate valid usernames from Office 365 using ActiveSync - Autodiscover v1 or office.com login page. | T1595 - T1595.002 - T1114 - T1114.001 - T1087 - T1087.002 | TA0040 - TA0010 - TA0007 | N/A | N/A | Exploitation tool | https://github.com/gremwell/o365enum | 1 | 0 | #GUIDproject | N/A | 7 | 3 | 267 | 39 | 2024-05-02T07:45:31Z | 2020-02-18T12:22:50Z | 23682 |
166 | *29548EB7-5E44-21F9-5C82-15DDDC80449A* | .{0,1000}29548EB7\-5E44\-21F9\-5C82\-15DDDC80449A.{0,1000} | greyware_tool_keyword | RemCom | Remote Command Executor: A OSS replacement for PsExec and RunAs | T1077 - T1059 - T1021 - T1569.002 | TA0002 - TA0005 - TA0008 | N/A | APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando | Lateral Movement | https://github.com/kavika13/RemCom | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 346 | 100 | 2017-10-30T04:48:38Z | 2011-11-09T11:00:09Z | 23687 |
167 | *2963C954-7B1E-47F5-B4FA-2FC1F0D56AEA* | .{0,1000}2963C954\-7B1E\-47F5\-B4FA\-2FC1F0D56AEA.{0,1000} | offensive_tool_keyword | SharpStay | SharpStay - .NET Persistence | T1031 - T1053 - T1059 - T1060 - T1063 - T1120 - T1123 | TA0003 | N/A | N/A | Persistence | https://github.com/0xthirteen/SharpStay | 1 | 0 | #GUIDproject | N/A | 10 | 5 | 475 | 97 | 2024-06-26T15:54:52Z | 2020-01-24T22:22:07Z | 23692 |
168 | *2963C954-7B1E-47F5-B4FA-2FC1F0D56AEA* | .{0,1000}2963C954\-7B1E\-47F5\-B4FA\-2FC1F0D56AEA.{0,1000} | offensive_tool_keyword | SharpStay | SharpStay - .NET Persistence | T1031 - T1053 - T1059 - T1060 - T1063 - T1120 - T1123 | TA0003 | N/A | N/A | Persistence | https://github.com/0xthirteen/SharpStay | 1 | 0 | #GUIDproject | N/A | 10 | 5 | 475 | 97 | 2024-06-26T15:54:52Z | 2020-01-24T22:22:07Z | 23693 |
169 | *29CBBC24-363F-42D7-B018-5EF068BA8777* | .{0,1000}29CBBC24\-363F\-42D7\-B018\-5EF068BA8777.{0,1000} | offensive_tool_keyword | PPLmedic | Dump the memory of any PPL with a Userland exploit chain | T1003 - T1055 - T1564.001 | TA0005 - TA0006 - TA0009 | N/A | N/A | Credential Access | https://github.com/itm4n/PPLmedic | 1 | 0 | #GUIDproject | N/A | 8 | 4 | 333 | 36 | 2023-03-17T15:58:24Z | 2023-03-10T12:07:01Z | 23717 |
170 | *29CFAA16-9277-4EFB-9E91-A7D11225160B* | .{0,1000}29CFAA16\-9277\-4EFB\-9E91\-A7D11225160B.{0,1000} | offensive_tool_keyword | SharpSpray | SharpSpray is a Windows domain password spraying tool written in .NET C# | T1110 | TA0006 | N/A | N/A | Credential Access | https://github.com/iomoath/SharpSpray | 1 | 0 | #GUIDproject | N/A | 10 | 2 | 130 | 21 | 2021-11-25T19:13:56Z | 2021-08-31T16:09:45Z | 23719 |
171 | *29E4E73B-EBA6-495B-A76C-FBB462196C64* | .{0,1000}29E4E73B\-EBA6\-495B\-A76C\-FBB462196C64.{0,1000} | greyware_tool_keyword | rdpwrap | RDP Wrapper Library used by malwares | T1021 | TA0008 | N/A | N/A | Lateral Movement | https://github.com/stascorp/rdpwrap | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 15332 | 3911 | 2024-06-18T15:08:33Z | 2014-10-22T23:18:28Z | 23725 |
172 | *2AD3951D-DEA6-4CF7-88BE-4C73344AC9DA* | .{0,1000}2AD3951D\-DEA6\-4CF7\-88BE\-4C73344AC9DA.{0,1000} | offensive_tool_keyword | PrivFu | ArtsOfGetSystem privesc tools | T1134 - T1134.001 - T1078 - T1059 - T1075 | TA0004 | N/A | N/A | Privilege Escalation | https://github.com/daem0nc0re/PrivFu/ | 1 | 0 | #GUIDproject | ArtsOfGetSystem | 10 | 9 | 849 | 122 | 2025-01-21T05:22:50Z | 2021-12-28T13:14:25Z | 23775 |
173 | *2AE886C3-3272-40BE-8D3C-EBAEDE9E61E1* | .{0,1000}2AE886C3\-3272\-40BE\-8D3C\-EBAEDE9E61E1.{0,1000} | offensive_tool_keyword | DeadPotato | DeadPotato is a windows privilege escalation utility from the Potato family of exploits leveraging the SeImpersonate right to obtain SYSTEM privileges | T1134.001 - T1068 - T1055 - T1546.015 | TA0004 - TA0006 - TA0011 | N/A | N/A | Privilege Escalation | https://github.com/lypd0/DeadPotato | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 382 | 45 | 2024-08-17T06:08:29Z | 2024-07-31T01:08:30Z | 23780 |
174 | *2AE886C3-3272-40BE-8D3C-EBAEDE9E61E1* | .{0,1000}2AE886C3\-3272\-40BE\-8D3C\-EBAEDE9E61E1.{0,1000} | offensive_tool_keyword | godpotato | GodPotato is an advanced privilege escalation tool that utilizes research on DCOM and builds upon years of Potato techniques. It enables privilege escalation to NT AUTHORITY\SYSTEM on Windows systems from 2012 to 2022 by leveraging the ImpersonatePrivilege permission. It addresses limitations of previous Potato versions and can run on almost any Windows OS by exploiting rpcss vulnerabilities. | T1134.001 - T1068 - T1055 - T1546.015 | TA0004 - TA0006 - TA0011 | Ghost Ransomware | N/A | Privilege Escalation | https://github.com/BeichenDream/GodPotato | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1938 | 236 | 2023-11-24T19:22:31Z | 2022-12-23T14:37:00Z | 23781 |
175 | *2AE886C3-3272-40BE-8D3C-EBAEDE9E61E1* | .{0,1000}2AE886C3\-3272\-40BE\-8D3C\-EBAEDE9E61E1.{0,1000} | offensive_tool_keyword | SigmaPotato | SeImpersonate privilege escalation tool | T1134 - T1055 - T1543 | TA0004 - TA0005 - TA0003 | N/A | N/A | Privilege Escalation | https://github.com/tylerdotrar/SigmaPotato | 1 | 0 | #GUIDproject | N/A | 9 | 4 | 326 | 38 | 2024-05-16T23:46:04Z | 2023-09-09T01:35:42Z | 23782 |
176 | *2B47F84C-9CA3-47E9-9970-8AF8233A9F12* | .{0,1000}2B47F84C\-9CA3\-47E9\-9970\-8AF8233A9F12.{0,1000} | offensive_tool_keyword | Lime-RAT | remote administration tool for Windows (RAT) | T1059 - T1573.001 - T1027 - T1091 - T1486 - T1036 - T1560 - T1566 - T1480 - T1498 - T1113 - T1083 - T1016 - T1105 - T1056 - T1021 - T1112 - T1082 - T1072 - T1076 - T1078 - T1209 - T1003 - T1012 - T1100 - T1135 - T1108 - T1029 - T1547 - T1053 - T1060 - T1102 - T1124 - T1049 - T1123 - T1145 - T1210 - T1046 - T1010 - T1055 | TA0040 - TA0010 - TA0005 - TA0011 - TA0043 - TA0006 - TA0042 - TA0008 - TA0009 - TA0007 - TA0002 - TA0003 | N/A | APT-C-36 - Operation Comando | Malware | https://github.com/NYAN-x-CAT/Lime-RAT | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1086 | 413 | 2019-06-24T17:05:48Z | 2018-02-07T15:35:56Z | 23802 |
177 | *2B704D89-41B9-4051-A51C-36A82ACEBE10* | .{0,1000}2B704D89\-41B9\-4051\-A51C\-36A82ACEBE10.{0,1000} | offensive_tool_keyword | PrivFu | SeTcbPrivilege exploitation | T1134 - T1134.001 - T1078 - T1059 - T1075 | TA0004 | N/A | N/A | Privilege Escalation | https://github.com/daem0nc0re/PrivFu/ | 1 | 0 | #GUIDproject | PrivFu\PowerOfTcb | 10 | 9 | 849 | 122 | 2025-01-21T05:22:50Z | 2021-12-28T13:14:25Z | 23816 |
178 | *2B914EE7-F206-4A83-B435-460D054315BB* | .{0,1000}2B914EE7\-F206\-4A83\-B435\-460D054315BB.{0,1000} | offensive_tool_keyword | ConfuserEx | ConfuserEx is a widely used open source obfuscator often found in malware | T1027 - T1045 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/yck1509/ConfuserEx | 1 | 0 | #GUIDproject | N/A | 6 | 10 | 3629 | 1661 | 2019-05-14T14:23:56Z | 2014-03-28T07:00:26Z | 23819 |
179 | *2C059FE7-C868-4C6D-AFA0-D62BA3C1B2E1* | .{0,1000}2C059FE7\-C868\-4C6D\-AFA0\-D62BA3C1B2E1.{0,1000} | offensive_tool_keyword | ConfuserEx | ConfuserEx is a widely used open source obfuscator often found in malware | T1027 - T1045 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/yck1509/ConfuserEx | 1 | 0 | #GUIDproject | N/A | 6 | 10 | 3629 | 1661 | 2019-05-14T14:23:56Z | 2014-03-28T07:00:26Z | 23853 |
180 | *2C6D323A-B51F-47CB-AD37-972FD051D475* | .{0,1000}2C6D323A\-B51F\-47CB\-AD37\-972FD051D475.{0,1000} | offensive_tool_keyword | MultiDump | MultiDump is a post-exploitation tool for dumping and extracting LSASS memory discreetly | T1003 - T1564.002 | TA0005 - TA0006 | N/A | N/A | Credential Access | https://github.com/Xre0uS/MultiDump | 1 | 0 | #GUIDproject | N/A | 10 | 6 | 510 | 66 | 2025-03-28T10:40:27Z | 2024-02-02T05:56:29Z | 23880 |
181 | *2C809982-78A1-4F1C-B0E8-C957C93B242F* | .{0,1000}2C809982\-78A1\-4F1C\-B0E8\-C957C93B242F.{0,1000} | offensive_tool_keyword | Dirty-Vanity | injection technique abusing windows fork API to evade EDRs | T1055 - T1562 - T1070 - T1027 | TA0005 - TA0006 | N/A | N/A | Defense Evasion | https://github.com/deepinstinct/Dirty-Vanity | 1 | 0 | #GUIDproject | N/A | 10 | 7 | 633 | 86 | 2022-12-23T10:54:10Z | 2022-11-24T10:54:00Z | 23887 |
182 | *2CFB9E9E-479D-4E23-9A8E-18C92E06B731* | .{0,1000}2CFB9E9E\-479D\-4E23\-9A8E\-18C92E06B731.{0,1000} | offensive_tool_keyword | NoFilter | Tool for abusing the Windows Filtering Platform for privilege escalation. It can launch a new console as NT AUTHORITY\SYSTEM or as another user that is logged on to the machine. | T1548 - T1548.002 - T1055 - T1055.004 | TA0004 - TA0003 | N/A | N/A | Privilege Escalation | https://github.com/deepinstinct/NoFilter | 1 | 0 | #GUIDproject | N/A | 9 | 3 | 298 | 48 | 2024-10-29T07:30:35Z | 2023-07-30T09:25:38Z | 23912 |
183 | *2D6FDD44-39B1-4FF8-8AE0-60A6B0979F5F* | .{0,1000}2D6FDD44\-39B1\-4FF8\-8AE0\-60A6B0979F5F.{0,1000} | offensive_tool_keyword | r77-rootkit | Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections | T1014 - T1055 - T1055.013 - T1060 - T1106 - T1070.009 | TA0005 - TA0003 | N/A | N/A | Persistence | https://github.com/bytecode77/r77-rootkit | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1884 | 425 | 2025-03-25T17:59:20Z | 2017-12-17T13:04:14Z | 23942 |
184 | *2D863D7A-A369-419C-B4B3-54BDB88B5816* | .{0,1000}2D863D7A\-A369\-419C\-B4B3\-54BDB88B5816.{0,1000} | offensive_tool_keyword | UsoDllLoader | This PoC shows a technique that can be used to weaponize privileged file write vulnerabilities on Windows. It provides an alternative to the DiagHub DLL loading exploit | T1210.001 - T1055 - T1574.001 | TA0007 - TA0002 - TA0001 | N/A | N/A | Exploitation tool | https://github.com/itm4n/UsoDllLoader | 1 | 0 | #GUIDproject | N/A | N/A | 4 | 386 | 100 | 2020-06-06T11:05:12Z | 2019-08-01T17:58:16Z | 23946 |
185 | *2deff2ca-c313-4d85-aeee-414bac32e7ae* | .{0,1000}2deff2ca\-c313\-4d85\-aeee\-414bac32e7ae.{0,1000} | offensive_tool_keyword | hotkeyz | Hotkey-based keylogger for Windows | T1056.001 | TA0006 - TA0009 | N/A | N/A | Sniffing & Spoofing | https://github.com/yo-yo-yo-jbo/hotkeyz | 1 | 0 | #GUIDproject | N/A | 9 | 1 | 21 | 1 | 2024-10-17T17:50:19Z | 2024-06-03T21:23:16Z | 23969 |
186 | *2E98B8D4-7A26-4F04-A95D-2051B0AB884C* | .{0,1000}2E98B8D4\-7A26\-4F04\-A95D\-2051B0AB884C.{0,1000} | offensive_tool_keyword | S-inject | Windows injection of x86/x64 DLL and Shellcode | T1055 - T1027 | TA0002 - TA0005 - TA0003 | N/A | N/A | Defense Evasion | https://github.com/Joe1sn/S-inject | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 313 | 45 | 2025-04-06T08:06:39Z | 2024-02-05T04:39:10Z | 24032 |
187 | *2E9B1462-F47C-48CA-9D85-004493892381* | .{0,1000}2E9B1462\-F47C\-48CA\-9D85\-004493892381.{0,1000} | offensive_tool_keyword | p0wnedShell | p0wnedShell is an offensive PowerShell host application written in C# that does not rely on powershell.exe but runs powershell commands and functions within a powershell runspace environment (.NET). It has a lot of offensive PowerShell modules and binaries included to make the process of Post Exploitation easier. What we tried was to build an ?all in one? Post Exploitation tool which we could use to bypass all mitigations solutions (or at least some off). and that has all relevant tooling included. You can use it to perform modern attacks within Active Directory environments and create awareness within your Blue team so they can build the right defense strategies. | T1086 - T1059 - T1106 - T1566 | TA0002 - TA0003 - TA0007 | N/A | N/A | Defense Evasion | https://github.com/Cn33liz/p0wnedShell | 1 | 0 | #GUIDproject | N/A | 9 | 10 | 1535 | 335 | 2019-08-02T16:24:39Z | 2015-12-25T11:44:37Z | 24033 |
188 | *2F00A05B-263D-4FCC-846B-DA82BD684603* | .{0,1000}2F00A05B\-263D\-4FCC\-846B\-DA82BD684603.{0,1000} | offensive_tool_keyword | SharpDPAPI | SharpDPAPI is a C# port of some Mimikatz DPAPI functionality. | T1552.002 - T1059.001 - T1112 - T1649 | TA0006 - TA0002 | N/A | Conti | Credential Access | https://github.com/GhostPack/SharpDPAPI | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1232 | 215 | 2024-06-27T13:39:08Z | 2018-08-22T17:39:31Z | 24072 |
189 | *2F00A05B-263D-4FCC-846B-DA82BD684603* | .{0,1000}2F00A05B\-263D\-4FCC\-846B\-DA82BD684603.{0,1000} | offensive_tool_keyword | SharpPack | collection of C# tools that include functionalities like Kerberoasting - ticket manipulation - Mimikatz - privilege escalation - domain enumeration and more | T1558.003 - T1003 - T1059.004 - T1078 - T1212 - T1087 - T1016 - T1071 - T1555 - T1203 | TA0003 - TA0004 - TA0006 - TA0008 - TA0009 - TA0011 | N/A | N/A | Exploitation tool | https://github.com/Lexus89/SharpPack | 1 | 0 | #GUIDproject | N/A | 10 | 1 | 78 | 19 | 2019-08-12T13:25:25Z | 2018-10-01T12:45:16Z | 24073 |
190 | *2f00a05b-263d-4fcc-846b-da82bd684603* | .{0,1000}2f00a05b\-263d\-4fcc\-846b\-da82bd684603.{0,1000} | offensive_tool_keyword | Telemetry | Abusing Windows Telemetry for persistence through registry modifications and scheduled tasks to execute arbitrary commands with system-level privileges. | T1053 - T1547 - T1059 | TA0003 - TA0005 - TA0004 | N/A | N/A | Privilege Escalation | https://github.com/Imanfeng/Telemetry | 1 | 0 | #GUIDproject | N/A | 9 | 2 | 140 | 13 | 2020-07-02T09:41:27Z | 2020-06-24T16:30:44Z | 24074 |
191 | *2F8E74D2-3474-408C-9469-A4E3C97B7BBF* | .{0,1000}2F8E74D2\-3474\-408C\-9469\-A4E3C97B7BBF.{0,1000} | offensive_tool_keyword | Carbanak | remote backdoor used by a group of the same name (Carbanak). It is intended for espionage - data exfiltration and providing remote access to infected machines | T1021.002 - T1071.001 - T1105 - T1059 - T1003 - T1078 - T1041 | TA0006 - TA0008 - TA0010 - TA0011 | Carbanak | FIN7 - Carbanak | Malware | https://github.com/0x25bit/Updated-Carbanak-Source-with-Plugins | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 396 | 223 | 2019-05-01T23:31:35Z | 2019-04-22T21:01:08Z | 24106 |
192 | *2FB94059-2D49-4EEA-AAF8-7E89E249644B* | .{0,1000}2FB94059\-2D49\-4EEA\-AAF8\-7E89E249644B.{0,1000} | offensive_tool_keyword | VectorKernel | PoCs for Kernelmode rootkit techniques research. | T1543 - T1055 - T1134 - T1564 - T1070 - T1057 - T1574 - T1562 - T1082 - T1518 | TA0003 - TA0005 - TA0004 - TA0008 - TA0007 | N/A | N/A | Exploitation tool | https://github.com/daem0nc0re/VectorKernel/ | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 367 | 60 | 2025-01-21T08:22:42Z | 2023-11-23T12:36:31Z | 24118 |
193 | *2FE6C1D0-0538-48DB-B4FA-55F0296A5150* | .{0,1000}2FE6C1D0\-0538\-48DB\-B4FA\-55F0296A5150.{0,1000} | offensive_tool_keyword | win-brute-logon | Crack any Microsoft Windows users password without any privilege (Guest account included) | T1110.001 - T1078.001 - T1187 - T1055 - T1547 - T1003.005 | TA0006 - TA0008 - TA0005 | N/A | N/A | Credential Access | https://github.com/PhrozenIO/win-brute-logon | 1 | 0 | #GUIDproject | N/A | 7 | 10 | 1138 | 191 | 2023-11-09T10:37:58Z | 2020-05-14T21:46:50Z | 24138 |
194 | *2FEB96F5-08E6-48A3-B306-794277650A08* | .{0,1000}2FEB96F5\-08E6\-48A3\-B306\-794277650A08.{0,1000} | greyware_tool_keyword | PAExec | PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program | T1047 - T1105 - T1204 | TA0003 - TA0008 - TA0040 | N/A | N/A | Lateral Movement | https://github.com/poweradminllc/PAExec | 1 | 0 | #GUIDproject | N/A | 10 | 6 | 560 | 177 | 2025-02-21T15:14:44Z | 2013-11-13T04:05:27Z | 24140 |
195 | *2FEB96F5-08E6-48A3-B306-794277650A08* | .{0,1000}2FEB96F5\-08E6\-48A3\-B306\-794277650A08.{0,1000} | greyware_tool_keyword | PAExec | PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program | T1047 - T1105 - T1204 | TA0003 - TA0008 - TA0040 | N/A | N/A | Lateral Movement | https://github.com/poweradminllc/PAExec | 1 | 0 | #GUIDproject | N/A | 10 | 6 | 560 | 177 | 2025-02-21T15:14:44Z | 2013-11-13T04:05:27Z | 24141 |
196 | *304D5A8A-EF98-4E21-8F4D-91E66E0BECAC* | .{0,1000}304D5A8A\-EF98\-4E21\-8F4D\-91E66E0BECAC.{0,1000} | offensive_tool_keyword | UACME | Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor. | T1548 - T1547 - T1218 | TA0002 - TA0005 - TA0004 | N/A | Evilnum | Defense Evasion | https://github.com/hfiref0x/UACME | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 6711 | 1348 | 2025-03-09T03:33:26Z | 2015-03-28T12:04:33Z | 24175 |
197 | *307088B9-2992-4DE7-A57D-9E657B1CE546* | .{0,1000}307088B9\-2992\-4DE7\-A57D\-9E657B1CE546.{0,1000} | offensive_tool_keyword | Dumpert | Dumpert. an LSASS memory dumper using direct system calls and API unhooking Recent malware research shows that there is an increase in malware that is using direct system calls to evade user-mode API hooks used by security products. This tool demonstrates the use of direct System Calls and API unhooking and combine these techniques in a proof of concept code which can be used to create a LSASS memory dump using Cobalt Strike. while not touching disk and evading AV/EDR monitored user-mode API calls. | T1055.011 - T1003 - T1562.001 - T1027 | TA0005 - TA0006 | N/A | Dispossessor | Credential Access | https://github.com/outflanknl/Dumpert | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1523 | 246 | 2021-01-05T08:58:26Z | 2019-06-17T18:22:01Z | 24182 |
198 | *30B8883F-A0A2-4256-ADCF-A790525D3696* | .{0,1000}30B8883F\-A0A2\-4256\-ADCF\-A790525D3696.{0,1000} | offensive_tool_keyword | ConfuserEx | ConfuserEx is a widely used open source obfuscator often found in malware | T1027 - T1045 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/yck1509/ConfuserEx | 1 | 0 | #GUIDproject | N/A | 6 | 10 | 3629 | 1661 | 2019-05-14T14:23:56Z | 2014-03-28T07:00:26Z | 24205 |
199 | *310FC5BE-6F5E-479C-A246-6093A39296C0* | .{0,1000}310FC5BE\-6F5E\-479C\-A246\-6093A39296C0.{0,1000} | offensive_tool_keyword | xeno-rat | Xeno-RAT is an open-source remote access tool (RAT) developed in C# providing a comprehensive set of features for remote system management. Has features such as HVNC - live microphone - reverse proxy and much much more | T1133 - T1021.001 - T1563.002 - T1113 - T1123 - T1571 - T1090 | TA0001 - TA0002 - TA0003 - TA0005 - TA0006 - TA0009 - TA0011 | N/A | N/A | C2 | https://github.com/moom825/xeno-rat | 1 | 0 | #GUIDproject | N/A | 10 | 10 | 1225 | 323 | 2024-03-05T06:22:36Z | 2023-10-17T06:41:56Z | 24229 |
200 | *315C301F-E392-4F7D-9108-8E621C11D662* | .{0,1000}315C301F\-E392\-4F7D\-9108\-8E621C11D662.{0,1000} | offensive_tool_keyword | Carbanak | remote backdoor used by a group of the same name (Carbanak). It is intended for espionage - data exfiltration and providing remote access to infected machines | T1021.002 - T1071.001 - T1105 - T1059 - T1003 - T1078 - T1041 | TA0006 - TA0008 - TA0010 - TA0011 | Carbanak | FIN7 - Carbanak | Malware | https://github.com/0x25bit/Updated-Carbanak-Source-with-Plugins | 1 | 0 | #GUIDproject | N/A | 10 | 4 | 396 | 223 | 2019-05-01T23:31:35Z | 2019-04-22T21:01:08Z | 24253 |
201 | *32223BE8-3E78-489C-92ED-7900B26DFF43* | .{0,1000}32223BE8\-3E78\-489C\-92ED\-7900B26DFF43.{0,1000} | offensive_tool_keyword | ConfuserEx | ConfuserEx is a widely used open source obfuscator often found in malware | T1027 - T1045 | TA0005 | N/A | N/A | Defense Evasion | https://github.com/yck1509/ConfuserEx | 1 | 0 | #GUIDproject | N/A | 6 | 10 | 3629 | 1661 | 2019-05-14T14:23:56Z | 2014-03-28T07:00:26Z | 24314 |
202 | *326D0AB1-CF2F-4A9B-B612-04B62D4EBA89* | .{0,1000}326D0AB1\-CF2F\-4A9B\-B612\-04B62D4EBA89.{0,1000} | offensive_tool_keyword | shutter | The goal of Shutter is to manage windows network stack communication via Windows Filtering Platform. Management can include blocking or permiting traffic based on IP or an executable that initiates or receives the traffic. | T1562 - T1027 | TA0005 - TA0007 | N/A | N/A | Defense Evasion | https://github.com/dsnezhkov/shutter | 1 | 0 | #GUIDproject | N/A | 10 | 2 | 116 | 15 | 2021-05-12T19:05:14Z | 2021-05-12T18:51:03Z | 24327 |