An advanced lateral movement technique to upload and execute custom payloads on remote targets.

Blog: https://www.deepinstinct.com/blog/forget-psexec-dcom-upload-execute-backdoor

https://github.com/deepinstinct/DCOMUploadExec

PendingFileRenameOperations + Junctions EDR Disable

https://github.com/rad9800/FileRenameJunctionsEDRDisable

A Rust implementation of Internal-Monologue — retrieving NetNTLM hashes without touching LSASS, leveraging SSPI for NTLM negotiation and indirect NTAPIs for core operations.
https://github.com/safedv/RustSoliloquy

A BloodHound collector for Microsoft Configuration Manager
https://github.com/CrowdStrike/sccmhound

early cascade process injection method
https://github.com/0xNinjaCyclone/EarlyCascade

A repository of credential stealer formats
https://github.com/MalBeacon/what-is-this-stealer

POC exploit for CVE-2024-49138
https://github.com/MrAle98/CVE-2024-49138-POC

CVE-2024-27397

https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2024-27397_mitigation/docs/exploit.md

Microsoft Configuration Manager (ConfigMgr / SCCM) 2403 Unauthenticated SQL injections (CVE-2024-43468) exploit
https://github.com/synacktiv/CVE-2024-43468

A new reverse shell called ReverseShell_2025_01.ps1 has been added to the repository. As of January 28, 2025, no antivirus vendors have flagged this file as malicious.
https://github.com/tihanyin/PSSW100AVB/blob/main/ReverseShell_2025_01.ps1

Proof of concept WMI virus. Does what it looks like it does. Virus isn't stored on the filsystem (in any way an AV would detect), but within the WMI. Contains PoC code for extracting it from the WMI- which can also be achieved at boot from within the WMI itself using powershell. So, self-extracting WMI virus that never touches the disk.
https://github.com/pulpocaminante/Stuxnet

https://github.com/RedTeamPentesting/pretender
Your MitM sidekick for relaying attacks featuring DHCPv6 DNS takeover as well as mDNS, LLMNR and NetBIOS-NS spoofing

Tired of using ts::multirdp, because Mimikatz is a nogo nowadays and get's flagged anyway most of the time? 🧐

Well, here is a standalone patching implementation with Win11 support:

Easy to port to a BOF/Coff🤠🔥
https://gist.github.com/S3cur3Th1sSh1t/8294ec59d1ef38cba661697edcfacb9b

https://x.com/ShitSecure/status/1887519686251676034

DECeption with Evaluative Integrated Validation Engine (DECEIVE): Let an LLM do all the hard honeypot work!
https://github.com/splunk/DECEIVE

Reaping treasures from strings in remote processes memory

https://github.com/boku7/StringReaper

A tool which bypasses AMSI (AntiMalware Scan Interface) and PowerShell CLM (Constrained Language Mode) and gives you a FullLanguage PowerShell reverse shell.
https://github.com/Sh3lldon/FullBypass