Just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden (null terminated) registry key. This works by adding a null byte in front of the UNICODE_STRING key valuename.
The Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification.
SharPyShell - tiny and obfuscated ASP.NET webshell for C# web applications
Windows persistence toolkit written in C#. For detailed usage information on each technique, see the Wiki.
The main features of fireeye/sharpersist are: Persistence, Windows Persistence.
Open-source alternatives to fireeye/sharpersist include: outflanknl/sharphide — Just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden (null… harmj0y/damp — The Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification. antoniococo/sharpyshell — SharPyShell - tiny and obfuscated ASP.NET webshell for C# web applications. blackarrowsec/pivotnacci — Pivot into the internal network by deploying HTTP agents. Pivotnacci allows you to create a socks server which… eladshamir/whisker. ben0xa/doucme.