Windows Events Attack Samples

Weaponize DLL hijacking easily. Backdoor any function in any DLL.

Resources About Windows Security. 1100+ Open Source Tools. 3300+ Blog Post and Videos.

A desktop application that checks security-related settings and makes recommendations for improvements without requiring central device management or automated reporting.

:fish: PoC of a VBA macro spawning a process with a spoofed parent and command line.

List of Awesome Windows Security Resources

Manipulating and Abusing Windows Access Tokens.

Windows 11 secure group policy for standalone devices

Run a program as TrustedInstaller (SYSTEM)

Disable Microsoft Windows Defender, Security app, Smartscreen, completely without remove and broke Windows image integrity

Automated CIS Benchmark Compliance Remediation for Windows Server 2019 with Ansible

Enterprise-Grade Security & Privacy Hardening Tool for Windows 11 25H2

Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass

Automated CIS Benchmark Compliance Remediation for Windows Server 2022 with Ansible

A collection of awesome ethical hacking and security related content!

Rust Windows EDR (user-mode, no driver): ETW → Sysmon-style normalization → Sigma/Yara/IOC detection → ECS NDJSON alerts.

I-Espresso is a tool that enables users to generate Portable Executable (PE) files from batch scripts. Leveraging IExpress, it demonstrates how file extension spoofing can be used to evade detection.

Xploitra is a powerful reverse shell payload generator for educational and security testing. It offers customizable payloads with advanced obfuscation and session management, making it ideal for simulating real-world attack scenarios and assessing system security.

EDR & AV Bypass Arsenal— a comprehensive collection of tools, patches, and techniques for evading modern EDR and antivirus defenses.

A collection of awesome software, libraries, learning tutorials, documents and books, awesome resources and cool stuff about ARM and Windows Exploitation.

:mag: My favorite resources and tools for malware analysis.

Cobalt Strike Aggressor Script for identifying security products on Windows hosts — six enumeration methods rated by noise level, from silent in-process BOF to full PowerShell/WMI.

Automated STIG Benchmark Compliance Remediation for Windows Server 2019 with Ansible

Automated CIS Benchmark Compliance Remediation for Windows 11 Enterprise with Ansible

Cyberpatriot born Windows hardening script. It serves as a way to get to baseline and can help specialists further secure the machine.

PowerShell script helper to manage execution policy for current user — perfect for automation, scripting, and dev environments.

Automated CIS Benchmark Compliance Remediation for Windows Server 2016 with Ansible

🦀 RUSTVERSARY: A comprehensive repository of tools and scripts for malware development practices.

Detect leaks in security event logs.

A clear and structured cheatsheet designed for BloodHound users. This guide explains what BloodHound does, how to install it from scratch, and how to run common AD enumeration and analysis tasks. Built for beginners and professionals who want a quick reference while mapping Active Directory attack paths.