How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
Just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden (null terminated) registry key. This works by adding a null byte in front of the UNICODE_STRING key valuename.
The Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification.
SharPyShell - tiny and obfuscated ASP.NET webshell for C# web applications
Windows persistence toolkit written in C#. For detailed usage information on each technique, see the Wiki.
The main features of fireeye/sharpersist are: Persistence, Windows Persistence.
Projects with overlapping indexed features include: outflanknl/sharphide — Just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden (null… harmj0y/damp — The Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification. antoniococo/sharpyshell — SharPyShell - tiny and obfuscated ASP.NET webshell for C# web applications. blackarrowsec/pivotnacci — Pivot into the internal network by deploying HTTP agents. Pivotnacci allows you to create a socks server which… eladshamir/whisker — Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their… ben0xa/doucme.