LOLBAS is a curated database and knowledge base of signed Windows binaries that can be misused to bypass security restrictions and execute unauthorized code. It serves as a technical registry that maps trusted system files to their functional capabilities and the offensive tactics they enable. The project distinguishes itself by providing a capability-driven indexing system and a tactics registry that relates legitimate binary functionality to known security evasion techniques. It includes an association layer that links specific system binaries to attack patterns and tactical objectives, pro
The goal of this repository is to document the most common techniques to bypass AppLocker.
unDefender is the C++ implementation of a technique originally described by @jonasLyk in this Twitter thread. At its core, this technique revolves around changing the \Device\BootDevice symbolic link in the Windows Object Manager so that when Defender's WdFilter driver is unloaded and loaded…
This repo contains updates to the original concept and code by Prashant Mahajan (@prashant3535) while working at Sense of Security.
hlldz/invoke-phant0m 的主要功能包括：Defense Evasion, PowerShell Tooling。
hlldz/invoke-phant0m 的开源替代品包括： lolbas-project/lolbas — LOLBAS is a curated database and knowledge base of signed Windows binaries that can be misused to bypass security… api0cradle/ultimateapplockerbypasslist — The goal of this repository is to document the most common techniques to bypass AppLocker. aptortellini/undefender — unDefender is the C++ implementation of a technique originally described by @jonasLyk in this Twitter thread. At its… arno0x/powershellscripts. arvanaghi/sessiongopher. adrecon/adrecon — This repo contains updates to the original concept and code by Prashant Mahajan (@prashant3535) while working at Sense…