Test & upgrade your Linux security with:
- 31 persistence modules & 50+ techniques
- Easily revert changes post-testing
- Map to MITRE ATT&CK
- 10+ fresh additions: LD_PRELOAD, PAM backdoors, rootkits, and more!

https://github.com/Aegrah/PANIX

kapersky open-sourced GReAT’s plugin for the IDA Pro decompiler - an indispensable set of tools for analyzing malware, shellcodes, etc. Grab our secret ingredient for reverse engineering and check out the GIFs demonstrating its usage
https://github.com/KasperskyLab/hrtng

Boot Execute allows native applications—executables with the NtProcessStartup entry point and dependencies solely on ntdll.dll—to run prior to the complete initialization of the Windows operating system.
https://github.com/rad9800/BootExecuteEDR

ActiveScan++ Burp Suite Plugin
https://github.com/albinowax/ActiveScanPlusPlus

take ovet microsoft sccm
https://github.com/subat0mik/Misconfiguration-Manager/blob/main/attack-techniques/TAKEOVER/TAKEOVER-1/takeover-1_denoscription.md

An advanced lateral movement technique to upload and execute custom payloads on remote targets.

Blog: https://www.deepinstinct.com/blog/forget-psexec-dcom-upload-execute-backdoor

https://github.com/deepinstinct/DCOMUploadExec

PendingFileRenameOperations + Junctions EDR Disable

https://github.com/rad9800/FileRenameJunctionsEDRDisable

A Rust implementation of Internal-Monologue — retrieving NetNTLM hashes without touching LSASS, leveraging SSPI for NTLM negotiation and indirect NTAPIs for core operations.
https://github.com/safedv/RustSoliloquy

A BloodHound collector for Microsoft Configuration Manager
https://github.com/CrowdStrike/sccmhound

early cascade process injection method
https://github.com/0xNinjaCyclone/EarlyCascade

A repository of credential stealer formats
https://github.com/MalBeacon/what-is-this-stealer

POC exploit for CVE-2024-49138
https://github.com/MrAle98/CVE-2024-49138-POC

CVE-2024-27397

https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2024-27397_mitigation/docs/exploit.md

Microsoft Configuration Manager (ConfigMgr / SCCM) 2403 Unauthenticated SQL injections (CVE-2024-43468) exploit
https://github.com/synacktiv/CVE-2024-43468

A new reverse shell called ReverseShell_2025_01.ps1 has been added to the repository. As of January 28, 2025, no antivirus vendors have flagged this file as malicious.
https://github.com/tihanyin/PSSW100AVB/blob/main/ReverseShell_2025_01.ps1

Proof of concept WMI virus. Does what it looks like it does. Virus isn't stored on the filsystem (in any way an AV would detect), but within the WMI. Contains PoC code for extracting it from the WMI- which can also be achieved at boot from within the WMI itself using powershell. So, self-extracting WMI virus that never touches the disk.
https://github.com/pulpocaminante/Stuxnet

https://github.com/RedTeamPentesting/pretender
Your MitM sidekick for relaying attacks featuring DHCPv6 DNS takeover as well as mDNS, LLMNR and NetBIOS-NS spoofing