Awesome

所有收集类项目

Windows

跟Windows安全有关的资源收集。当前包括的工具个数1100+，并根据功能进行了粗糙的分类。部分工具添加了中文描述。当前包括文章数3300+。
此页只包含部分内容. 查看完整版
English Version

PowerShell
- PowerSploit -> (4)工具 (12)文章
- PSAttack -> (3)工具 (3)文章
- 其他 -> (5)工具 (7)文章
DLL
- 新添加 -> (107)工具 (152)文章
- DLL注入 -> (67)工具 (69)文章
- DLL劫持 -> (18)工具 (60)文章
- DLL旁加载 -> (18)文章
PE
- PE解析 -> (1)工具 (3)文章
- 工具 -> (66)工具
- 文章 -> (131)文章
.NET
- 工具
  - (36) 新添加
  - (5) dnspy
- (56) 文章
登录与认证
- Mimikatz -> (13)工具 (128)文章
- NTLM -> (36)工具 (128)文章
- Kerberos -> (28)工具 (71)文章
- Pass-The-Hash -> (1)工具 (52)文章
- Pass-The-Ticket -> (3)文章
- winglogon.exe -> (1)工具 (6)文章
- LLMNR -> (5)工具 (18)文章
- NetBIOS -> (2)工具 (17)文章
- 其他 -> (2)工具
安全防护
- UAC -> (41)工具 (139)文章
- AppLocker -> (13)工具 (98)文章
- Data Execution Prevention(DEP) -> (1)工具 (68)文章
- Patch Guard(PG) -> (2)工具 (24)文章
- Driver Signature Enforcement(DSE) -> (11)工具 (11)文章
- Windows Defender -> (15)工具 (155)文章
- Antimalware Scan Interface(AMSI) -> (11)工具 (62)文章
- Address Space Layout Randomization(ASLR) -> (12)工具 (124)文章
- Control Flow Guard -> (4)工具
- Control Integrity Guard ->
- 其他 ->
MS1X -> (46)工具 (7)文章
系统机制
- RDP
  - (53) 工具
  - (70) 文章
  - (141) 文章_0
- SMB -> (61)工具 (51)文章
- Windows Management Instrumentation(WMI) -> (37)工具 (144)文章
- Event Tracing for Windows(ETW) -> (40)工具 (66)文章
- Lsass -> (7)工具 (22)文章
- BitLocker -> (10)工具 (50)文章
- NTFS -> (21)工具 (73)文章
- SSDT -> (11)工具 (57)文章
- Windows Registry -> (12)工具 (18)文章
- Component Object Model(COM) -> (1)工具
- Distributed Component Object Model(DCOM) -> (10)工具 (35)文章
- Dynamic Data Exchange(DDE) -> (5)文章
- Compiled HTML Help(CHM) -> (4)文章
- WinSxS -> (1)工具
- WoW64 -> (9)工具 (28)文章
- Background Intelligent Transfer Service(BITS) -> (2)工具
- Batch Script(.bat) -> (12)工具 (11)文章
- DACL -> (2)工具 (6)文章
- WebDAV -> (11)工具 (26)文章
- Group Policy Object(GPO) -> (1)工具 (4)文章
- AppInit/AppCert -> (4)文章
- InstallUtil -> (1)文章
- Image File Execution Option(IFEO) -> (5)文章
- Mshta -> (6)文章
- Microsoft HTML Application(HTA) -> (1)文章
- NetShell -> (2)工具 (1)文章
- VBScript -> (9)工具 (59)文章
- VBA -> (16)工具 (76)文章
- Security Service Provider(SSP) -> (8)文章
- Scheduled Task -> (6)工具 (9)文章
- Windows Remote Management(WinRM) -> (9)工具 (16)文章
- Control Panel -> (1)工具 (12)文章
- Windows Shortcut File -> (8)工具 (18)文章
- Windows Explorer -> (27)工具 (4)文章
- Application Shim -> (7)文章
- Squiblydoo -> (2)文章
- Open Office XML -> (1)工具
- 其他 ->
各类软件
- MS Internet Explorer -> (32)工具
- MS Edge -> (19)工具 (51)文章
- MS Office -> (17)工具 (190)文章
- EMET -> (3)工具 (118)文章
- psexec -> (3)工具 (42)文章
- Nltest ->
- CMSTP.exe ->
- Rundll32 -> (1)工具 (12)文章
- Regsvr32 -> (2)工具 (4)文章
- Regasm ->
- Regsvcs ->
- svchost -> (1)工具 (6)文章
- MSBuild -> (6)工具 (14)文章
- csrss.exe -> (21)文章
- 其他exe -> (23)文章
SysInternalSuite
- Sysmon -> (36)工具 (144)文章
- Procmon -> (4)工具 (18)文章
- Autoruns -> (7)工具 (17)文章
- ProcessExplorer -> (14)文章
- 其他 -> (5)工具 (20)文章
工具
文章
- (8) 新添加

<a id="686597a4cff20c60a8e86116cde645fb"></a>PowerShell

<a id="c65ce176ec6f9bbce520d5b97f4067db"></a>PowerSploit

<a id="65a67d0db02390cee295385191ee5ee0"></a>工具

[6448星][9d] [PS] powershellmafia/powersploit PowerSploit - A PowerShell Post-Exploitation Framework
[346星][1y] [C#] ghostpack/sharpdump SharpDump is a C# port of PowerSploit's Out-Minidump.ps1 functionality.
[213星][3m] [Py] the-useless-one/pywerview A (partial) Python rewriting of PowerSploit's PowerView

<a id="0ab243d6d9d07fd24d8aa9a44ea03e89"></a>文章

2018.12 [aliyun] Reel—在HackTheBox上的一次BloodHound & PowerSploit 活动目录渗透
2018.11 [bugbountywriteup] Reel — A BloodHound & PowerSploit Active Directory HackTheBox Walkthrough
2018.02 [hackers] PowerSploit, Part 1: How to Control Nearly any Windows System with Powersploit
2017.11 [mediaservice] A patch for PowerSploit’s Invoke-Shellcode.ps1
2017.06 [stealthbits] Exploiting Weak Active Directory Permissions with PowerSploit
2017.04 [freebuf] 说说Powersploit在内网渗透中的使用
2017.03 [jpcert] Malware Leveraging PowerSploit
2016.01 [sans] toolsmith #112: Red vs Blue - PowerSploit vs PowerForensics
2016.01 [holisticinfosec] toolsmith #112: Red vs Blue - PowerSploit vs PowerForensics
2015.05 [leonjza] jenkins to meterpreter toying with powersploit
2013.04 [freebuf] PowerSploit+Metasploit=Shells
2012.05 [freebuf] Post Exploitation工具 – PowerSploit

<a id="7a02de4887610ec52c49e64b95fe1580"></a>PSAttack

<a id="65edc029f91b76eab19a2adb39966d55"></a>工具

<a id="5f6fc3b3e1eac08f477163970696725e"></a>文章

2017.07 [freebuf] PSAttack：一个包含所有的渗透测试用例的攻击型Powershell脚本框架
2017.07 [4hou] PSattack：一个渗透测试中使用的万能框架
2016.11 [BSidesCHS] BSidesCHS 2016: "Adding PowerShell to your Arsenal with PSAttack" - Jared Haight

<a id="f00255b09a7cea498b2672c2c7447a04"></a>其他

<a id="882141dceab035af73809b75c83477f1"></a>工具

[216星][23d] [PS] mkellerman/invoke-commandas Invoke Command As System/Interactive/GMSA/User on Local/Remote machine & returns PSObjects.

<a id="06d2309e0637f481cdfac132c86142b3"></a>文章

2020.01 [4sysops] Invoke-Command: Compensating for slow responding computers
2019.12 [4sysops] Invoke-Command: Connecting to computers requiring different credentials
2019.12 [4sysops] Invoke-Command: Dealing with offline computers
2019.01 [sans] Start-Process PowerShell - Get Forensic Artifact
2018.12 [4sysops] Running PowerShell remotely as SYSTEM with Invoke-CommandAs
2013.12 [mikefrobbins] PowerShell Remoting Error When Trying to use Invoke-Command Against a Domain Controller
2013.01 [mikefrobbins] PowerShell Remoting Insanity with AppAssure and the Invoke-Command Cmdlet

<a id="89f963773ee87e2af6f9170ee60a7fb2"></a>DLL

<a id="4dcfd9135aa5321b7fa65a88155256f9"></a>新添加

<a id="9753a9d52e19c69dc119bf03e9d7c3d2"></a>工具

[2064星][10d] [C#] lucasg/dependencies A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues.
[1393星][12m] [C] fancycode/memorymodule Library to load a DLL from memory.
[1232星][10d] [C#] perfare/il2cppdumper Restore dll from Unity il2cpp binary file (except code)
[810星][10d] [C#] terminals-origin/terminals Terminals is a secure, multi tab terminal services/remote desktop client. It uses Terminal Services ActiveX Client (mstscax.dll). The project started from the need of controlling multiple connections simultaneously. It is a complete replacement for the mstsc.exe (Terminal Services) client. This is official source moved from Codeplex.
[396星][8m] [C++] hasherezade/dll_to_exe Converts a DLL into EXE
[385星][19d] [C#] 3f/dllexport .NET DllExport
- 重复区段: .NET->工具->新添加 |
[371星][12d] [PS] netspi/pesecurity PowerShell module to check if a Windows binary (EXE/DLL) has been compiled with ASLR, DEP, SafeSEH, StrongNaming, and Authenticode.
[255星][16d] [C++] wbenny/detoursnt Detours with just single dependency - NTDLL
[236星][21d] [C#] erfg12/memory.dll C# Hacking library for making PC game trainers.
[234星][1y] [C#] misaka-mikoto-tech/monohook hook C# method at runtime without modify dll file (such as UnityEditor.dll)
[220星][2m] [C++] chuyu-team/mint Contains the definitions for the Windows Internal UserMode API from ntdll.dll, samlib.dll and winsta.dll.
[203星][10d] [C++] s1lentq/regamedll_cs a result of reverse engineering of original library mod HLDS (build 6153beta) using DWARF debug info embedded into linux version of HLDS, cs.so

<a id="b05f4c5cdfe64e1dde2a3c8556e85827"></a>文章

2016.12 [sensepost] Rattler:Identifying and Exploiting DLL Preloading Vulnerabilities
2012.10 [netspi] Testing Applications for DLL Preloading Vulnerabilities
2010.08 [microsoft] More information about the DLL Preloading remote attack vector
2009.09 [evilcodecave] DllExportComparer
2009.07 [pediy] [原创]dll下载器分析
2009.07 [addxorrol] Poking around MSVIDCTL.DLL
2009.07 [rapid7] IE DirectShow (msvidctl.dll) MPEG-2 Metasploit Exploit
2009.07 [sans] 0-day in Microsoft DirectShow (msvidctl.dll) used in drive-by attacks
2009.07 [vexillium] DllMain and its uncovered possibilites
2009.07 [vexillium] DllMain and its uncovered possibilites
2009.06 [pediy] [原创]使用GCC创建 Windows NT 下的内核DLL
2009.06 [pediy] [Anti Virus专题]1.7 - 打造DLL内存加载引擎.
2009.05 [pediy] [原创]dll 全局api hook 一例(附代码)
2009.05 [pediy] [原创]Fengyue's DLL-Game.exe 加壳流程简单分析
2009.05 [travisgoodspeed] FET Firmware from MSP430.DLL
2009.05 [pediy] [原创]暴风影音2009(Config.dll)ActiveX远程栈溢出漏洞
2009.05 [pediy] [原创]暴风影音2009(mps.dll)ActiveX远程栈溢出漏洞
2009.04 [pediy] [求助]windows mobile dll的一个问题
2009.04 [pediy] 不需要依赖dllmain触发的CE注入代码
2009.03 [pediy] [原创]用DELPHI编写DLL插件为Windows记事本增加各种功能

<a id="3b4617e54405a32290224b729ff9f2b3"></a>DLL注入

<a id="b0d50ee42d53b1f88b32988d34787137"></a>工具

[994星][1m] [C] fdiskyou/injectallthethings Seven different DLL injection techniques in one single project.
[747星][7m] [C++] darthton/xenos Windows DLL 注入器
[635星][3m] [PS] monoxgas/srdi Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

<a id="1a0b0dab4cdbab08bbdc759bab70dbb6"></a>文章

2019.06 [aliyun] Windows 10 Task Scheduler服务DLL注入漏洞分析
2018.10 [pediy] [原创]代替创建用户线程使用ShellCode注入DLL的小技巧
2018.10 [4hou] 如何利用DLL注入绕过Win10勒索软件保护
2018.10 [0x00sec] Reflective Dll Injection - Any Way to check If a process is already injected?
2018.09 [pediy] [原创]win10_arm64 驱动注入dll 到 arm32程序
2018.08 [freebuf] sRDI：一款通过Shellcode实现反射型DLL注入的强大工具
2018.07 [4hou] 注入系列——DLL注入
2018.06 [0x00sec] Reflective DLL Injection - AV detects at runtime
2018.06 [qq] 【游戏漏洞】注入DLL显示游戏窗口
2017.12 [secist] Mavinject | Dll Injected
2017.12 [secvul] SSM终结dll注入
2017.10 [nsfocus] 【干货分享】Sandbox技术之DLL注入
2017.10 [freebuf] DLL注入新姿势：反射式DLL注入研究
2017.10 [pediy] [原创]通过Wannacry分析内核shellcode注入dll技术
2017.09 [360] Dll注入新姿势：SetThreadContext注入
2017.08 [silentbreaksecurity] sRDI – Shellcode Reflective DLL Injection
2017.08 [360] DLL注入那些事
2017.08 [freebuf] 系统安全攻防战：DLL注入技术详解
2017.08 [pediy] [翻译]多种DLL注入技术原理介绍
2017.07 [0x00sec] Reflective DLL Injection

<a id="f39e40e340f61ae168b67424baac5cc6"></a>DLL劫持

<a id="c9cdcc6f4acbeda6c8ac8f4a1ba1ea6b"></a>工具

[441星][9m] [Pascal] mojtabatajik/robber 查找易于发生DLL劫持的可执行文件
[327星][1y] [C++] anhkgg/superdllhijack 一种通用Dll劫持技术，不再需要手工导出Dll的函数接口了

<a id="01e95333e07439ac8326253aa8950b4f"></a>文章

2019.06 [4hou] 戴尔预装的SupportAssist组件存在DLL劫持漏洞，全球超过1亿台设备面临网络攻击风险
2019.05 [4hou] 《Lateral Movement — SCM and DLL Hijacking Primer》的利用扩展
2019.04 [3gstudent] 《Lateral Movement — SCM and DLL Hijacking Primer》的利用扩展
2019.04 [3gstudent] 《Lateral Movement — SCM and DLL Hijacking Primer》的利用扩展
2019.04 [specterops] Lateral Movement — SCM and Dll Hijacking Primer
2019.01 [sans] DLL Hijacking Like a Boss!
2018.11 [t00ls] 一种通用DLL劫持技术研究
2018.11 [pediy] [原创]一种通用DLL劫持技术研究
2018.09 [DoktorCranium] Understanding how DLL Hijacking works
2018.09 [astr0baby] Understanding how DLL Hijacking works
2018.08 [parsiya] DVTA - Part 5 - Client-side Storage and DLL Hijacking
2018.08 [parsiya] DVTA - Part 5 - Client-side Storage and DLL Hijacking
2018.06 [cybereason] Attackers incriminate a signed Oracle process for DLL hijacking, running Mimikatz
2018.05 [360] 独辟蹊径：如何通过URL文件实现DLL劫持
2018.05 [insert] 利用URL文件实现DLL劫持
2017.10 [cybereason] Siofra, a free tool built by Cybereason researcher, exposes DLL hijacking vulnerabilities in Windows programs
2017.08 [securiteam] SSD Advisory – Dashlane DLL Hijacking
2017.05 [4hou] Windows 下的 7 种 DLL 劫持技术
2017.05 [pediy] [原创]让代码飞出一段钢琴曲（freepiano小助手）（全局键盘钩子+dll劫持）+有码
2017.03 [pentestlab] DLL Hijacking

<a id="7f17d2efd0021063bd713a1b9ee2f46e"></a>DLL旁加载

<a id="ec3149509e7612fb1a2126948f141bc0"></a>文章

2016.04 [hackingarticles] Hack Remote Windows PC using Office OLE multiple DLL side loading vulnerabilities
2015.12 [securify] DLL side loading vulnerability in VMware Host Guest Client Redirector
2015.11 [securify] MapsUpdateTask Task DLL side loading vulnerability
2015.11 [securify] Shutdown UX DLL side loading vulnerability
2015.09 [securify] HP ToComMsg DLL side loading vulnerability
2015.09 [securify] BDA MPEG2 Transport Information Filter DLL side loading vulnerability
2015.09 [securify] NPS Datastore server DLL side loading vulnerability
2015.09 [securify] Windows Mail Find People DLL side loading vulnerability
2015.09 [securify] HP LaserJet Fax Preview DLL side loading vulnerability
2015.09 [securify] LEADTOOLS ActiveX control multiple DLL side loading vulnerabilities
2015.08 [securify] COM+ Services DLL side loading vulnerability
2015.08 [securify] Microsoft Visio multiple DLL side loading vulnerabilities
2015.08 [securify] OLE DB Provider for Oracle multiple DLL side loading vulnerabilities
2015.08 [securify] Shockwave Flash Object DLL side loading vulnerability
2015.08 [securify] Windows Authentication UI DLL side loading vulnerability
2015.08 [securify] Event Viewer Snapin multiple DLL side loading vulnerabilities
2015.06 [securify] Cisco AnyConnect elevation of privileges via DLL side loading
2010.08 [microsoft] An update on the DLL-preloading remote attack vector

<a id="620af0d32e6ac1f4a3e97385d4d3efc0"></a>PE

<a id="c9d6674c5ab3d9adb7fd295acb7ba7cf"></a>PE解析

<a id="3cb6b6d0c5f183fc7beed42c26733e39"></a>工具

[904星][12d] [Py] erocarrera/pefile PE文件读取、解析工具，Python编写 <details> <summary>查看详情</summary>

  ## 特性
  - Inspecting headers
  - Analysis of sections' data
  - Retrieving embedded data
  - Reading strings from the resources
  - Warnings for suspicious and malformed values
  - Support to write to some of the fields and to other parts of the PE, so it's possible to do some basic butchering of PEs
  - Packer detection with PEiD’s signatures
  - PEiD signature generation
  </details>

<a id="f644a8855d53c26fb4f9799d2733c8c8"></a>文章

2017.09 [] Binary offsets, virtual addresses and pefile
2017.03 [] 67,000 cuts with python-pefile
2009.05 [pediy] [原创]利用python+pefile库做PE格式文件的快速开发

<a id="574db8bbaafbee72eeb30e28e2799458"></a>工具

<a id="c364a31b0a48b1a528f728def1d3ca05"></a>工具

[693星][15d] [C] thewover/donut 生成位置无关的shellcode（x86，x64或AMD64 + x86），该shellcode从内存中加载.NET程序集、PE文件和其他Windows有效负载，并使用参数运行它们
- 重复区段: .NET->工具->新添加 |
[407星][2m] [Assembly] hasherezade/pe_to_shellcode Converts PE into a shellcode
[399星][5m] [Jupyter Notebook] endgameinc/ember 110万PE文件的数据集合, 可用于训练相关模型. PE文件信息主要包括: SHA256/histogram(直方图)/byteentropy(字节熵)/字符串/PE头信息/段信息/导入表/导出表
[372星][1y] [Assembly] egebalci/amber 反射式PE加壳器，用于绕过安全产品和缓解措施
[342星][7m] [C] merces/pev The PE file analysis toolkit
[328星][2m] [VBA] itm4n/vba-runpe A VBA implementation of the RunPE technique or how to bypass application whitelisting.
[327星][1m] [C++] trailofbits/pe-parse Principled, lightweight C/C++ PE parser
[318星][20d] [C++] hasherezade/libpeconv 用于映射和取消映射PE 文件的库
[288星][9m] [Java] katjahahn/portex Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

<a id="7e890d391fa32df27beb1377a371518b"></a>文章

<a id="bba6a2ee17956c3bd688c16acac5e502"></a>文章

2016.08 [3gstudent] 隐写技巧——在PE文件的数字证书中隐藏Payload
2016.08 [3gstudent] 隐写技巧——在PE文件的数字证书中隐藏Payload
2016.06 [pediy] [原创]菜鸟对PEid 0.95 Cave 查找功能逆向
2016.06 [mzrst] Professional PE Explorer – PPEE
2016.06 [pediy] [翻译]Windows PE文件中的数字签名格式
2016.05 [sans] CVE-2016-2208 Symantec Antivirus Engine Malformed PE Header Parser Memory Access Violation
2016.05 [freebuf] Manalyze：PE文件的静态分析工具
2016.04 [cyber] Presenting PeNet: a native .NET library for analyzing PE Headers with PowerShell
2016.02 [pediy] [原创]64位CreateProcess逆向:(三)PE格式的解析与效验
2016.02 [360] 在windows环境下使用Volatility或PE Capture捕捉执行代码（PE/DLL/驱动恶意文件）
2015.12 [secureallthethings] Add PE Code Signing to Backdoor Factory (BDF)
2015.12 [missmalware] PE Import Analysis for Beginners and Lazy People
2015.12 [pediy] [原创]一个C++的PE文件操作类
2015.12 [pediy] [原创]通过c++代码给PE文件添加一个区段
2015.11 [securityblog] FileAlyzer – Analyze files – Read PE information
2015.11 [securityblog] Read Portable Executable (PE) information
2015.11 [freebuf] 逆向工程（二）：从一个简单的实例来了解PE文件
2015.11 [pediy] [原创][开源]LordPE框架设计之精简版
2015.11 [pediy] [原创]手查PE重定向
2015.11 [pediy] [原创][开源]Win32控制台解析PE文件

<a id="b8c834b16722c108f8c30f1b0190f0a1"></a>.NET

<a id="d90b60dc79837e06d8ba2a7ee1f109d3"></a>工具

<a id="6b8b4bf156e5f973cf0485d45a94f4c4"></a>新添加

[9528星][19d] [C#] icsharpcode/ilspy .NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!
[3824星][2m] [C#] 0xd4d/de4dot .NET deobfuscator and unpacker.
[3278星][9m] [JS] sindresorhus/speed-test Test your internet connection speed and ping using speedtest.net from the CLI
[2526星][1y] [C#] yck1509/confuserex An open-source, free protector for .NET applications
[1811星][1m] [C#] sshnet/ssh.net SSH.NET is a Secure Shell (SSH) library for .NET, optimized for parallelism.
[1696星][19d] [C#] jbevain/cecil C#库, 探查/修改/生成 .NET App/库
[1535星][12d] [C#] steamre/steamkit SteamKit2 is a .NET library designed to interoperate with Valve's Steam network. It aims to provide a simple, yet extensible, interface to perform various actions on the network.
[1415星][1y] [C++] dotnet/llilc This repo contains LLILC, an LLVM based compiler for .NET Core. It includes a set of cross-platform .NET code generation tools that enables compilation of MSIL byte code to LLVM supported platforms.
[1147星][9d] [C#] cobbr/covenant Covenant is a collaborative .NET C2 framework for red teamers.
[1135星][15d] [Boo] byt3bl33d3r/silenttrinity An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR
[923星][12d] [C#] pwntester/ysoserial.net 生成Payload，恶意利用不安全的 .NET 对象反序列化
[818星][12d] [C#] proxykit/proxykit A toolkit to create code-first HTTP reverse proxies on ASP.NET Core
[788星][2m] [C#] cobbr/sharpsploit SharpSploit is a .NET post-exploitation library written in C#
[728星][3m] [C#] obfuscar/obfuscar Open source obfuscation tool for .NET assemblies
[693星][15d] [C] thewover/donut 生成位置无关的shellcode（x86，x64或AMD64 + x86），该shellcode从内存中加载.NET程序集、PE文件和其他Windows有效负载，并使用参数运行它们
- 重复区段: PE->工具->工具 |
[634星][12d] [HTML] foxzilla/pxer 人人可用的P站爬虫
[577星][10d] [C#] dabutvin/imgbot An Azure Function solution to crawl through all of your image files in GitHub and losslessly compress them. This will make the file size go down, but leave the dimensions and quality untouched. Once it's done, ImgBot will open a pull request for you to review and merge. help@imgbot.net
[546星][24d] [C#] crosire/scripthookvdotnet An ASI plugin for Grand Theft Auto V, which allows running scripts written in any .NET language in-game.
[536星][11d] [Go] timothyye/godns A dynamic DNS client tool, supports AliDNS, Cloudflare, Google Domains, DNSPod, HE.net & DuckDNS, written in Go.
[494星][28d] [C#] paulbartrum/jurassic A .NET library to parse and execute JavaScript code.
[493星][1m] [C#] chmorgan/sharppcap 用于捕获数据包的跨平台 (Windows, Mac, Linux)库，.NET编写
[486星][28d] [C#] tyranid/oleviewdotnet OLE/COM查看和检测工具，.NET语言编写
[424星][7m] [Java] nccgroup/freddy 自动识别 Java/.NET 应用程序中的反序列化漏洞
[386星][14d] [C#] addictedcs/soundfingerprinting .NET中的音频指纹识别。完全用C＃编写的高效的声音指纹识别算法。
[385星][19d] [C#] 3f/dllexport .NET DllExport
- 重复区段: DLL->新添加->工具 |
[383星][2m] [C#] security-code-scan/security-code-scan Vulnerability Patterns Detector for C# and VB.NET
[373星][9d] [C#] sonarsource/sonar-dotnet 用于C＃和VB.NET语言的静态代码分析器，用作SonarQube和SonarCloud平台的扩展。
[366星][10m] [JS] nikolayit/openjudgesystem An open source system for online algorithm competitions for Windows, written in ASP.NET MVC
[357星][10d] [C#] tmoonlight/nsmartproxy 内网穿透工具。采用.NET CORE的全异步模式打造
[334星][10d] [Java] wiglenet/wigle-wifi-wardriving Nethugging client for Android, from wigle.net
[320星][1m] [C#] azuread/azure-activedirectory-library-for-dotnet ADAL authentication libraries for .net
[316星][10d] [C#] dahall/vanara A set of .NET libraries for Windows implementing PInvoke calls to many native Windows APIs with supporting wrappers.

<a id="e26e6693fc840e27099c4363598e02cc"></a>dnspy

[13163星][24d] [C#] 0xd4d/dnspy .NET debugger and assembly editor

<a id="2612f712f9363ad0d71fc054c4829396"></a>文章

2011.11 [pcsxcetrasupport3] Converting VB Script To VB.Net
2011.10 [pediy] [原创]小小菜鸟爆破IphoneBackupextractor V3.08(.net)
2011.06 [pediy] [原创][.net]修復不能使用的115网盘地址解析工具
2011.02 [pediy] [原创]新发现一个简单有效的.net程序破解方法（可破隐藏IL级别的保护）
2010.12 [lowleveldesign] Writing a .net debugger (part 4) – breakpoints
2010.11 [pelock] .netshrink v2.0
2010.11 [lowleveldesign] Writing a .net debugger (part 3) – symbol and source files
2010.11 [sans] DNSSEC Progress for .com and .net
2010.10 [lowleveldesign] Writing a .net debugger (part 2) – handling events and creating wrappers
2010.10 [lowleveldesign] Writing a .net debugger (part 1) – starting the debugging session
2010.05 [pediy] [原创].Net内存程序集的DUMP(ProFile篇)
2010.01 [pediy] [原创].net逆向学习总结系列[2.24更新:.net逆向学习总结002(1)]
2008.06 [pediy] [原创]请求加精！绕过.Net 2.0强名称验证，解决混合代码无法反编译的问题。
2007.12 [pediy] [翻译]Win32asm tutorial (Asm.yeah.net)
2007.10 [pediy] [[翻译]].Net 下的保护和逆向工程](https://bbs.pediy.com/thread-52738.htm)
2007.07 [pediy] [原创].Net 2.0 通用反射脱壳机完整版
2007.07 [pediy] [原创].Net 反射脱壳机核心源代码
2007.05 [pediy] [原创].net jokeme 2
2007.04 [pediy] BSPR .net1.1保护壳内部测试
2007.03 [pediy] [原创].net的joke me

<a id="5dc38e490615f91e67ffb2f668c5088a"></a>登录与认证

<a id="360af8f1497fcc2dfd2e32f2b636d718"></a>Mimikatz

<a id="17f92a061cc661a040c094c1b3fd32e3"></a>工具

[9161星][11d] [C] gentilkiwi/mimikatz A little tool to play with Windows security
[802星][10d] [Py] skelsec/pypykatz 纯Python实现的Mimikatz
[264星][6m] [C] portcullislabs/linikatz UNIX版本的Mimikatz
[210星][2m] [C#] ghostpack/sharpdpapi SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.

<a id="c9617bf44965290de6f7b645c15328ea"></a>文章

2020.01 [matterpreter] Mimidrv In Depth: Exploring Mimikatz’s Kernel Driver
2019.12 [LoiLiangYang] Access Windows 10 Password with Empire and Mimikatz (Cybersecurity)
2019.12 [specterops] Mimidrv In Depth: Exploring Mimikatz’s Kernel Driver
2019.11 [sentinelone] What is Mimikatz? (And Why Is It So Dangerous?)
2019.10 [securestate] No More Mimikatz
2019.07 [4hou] 探索Mimikatz神器之SSP
2019.07 [markmotig] NetKatz, Mimikatz to Hex and Defender groans but shrugs
2019.07 [4hou] 探索 Mimikatz 神器之 WDigest
2019.06 [4hou] Mimikatz中SSP的使用
2019.06 [4hou] Mimikatz中sekurlsa::wdigest的实现
2019.06 [HackerSploit] PowerShell Empire Complete Tutorial For Beginners - Mimikatz & Privilege Escalation
2019.06 [vulnerablelife] Defending Windows Domain Against Mimikatz Attacks
2019.06 [360] 深入分析Mimikatz：WDigest
2019.06 [3gstudent] Mimikatz中SSP的使用
2019.06 [360] 深入分析Mimikatz：SSP
2019.06 [xpnsec] Exploring Mimikatz - Part 2 - SSP
2019.06 [3gstudent] Mimikatz中sekurlsa::wdigest的实现
2019.05 [malcomvetter] Choose Your Own Red Team Adventure: Mimikatz
2019.05 [xpnsec] Exploring Mimikatz - Part 1 - WDigest
2019.04 [crowdstrike] Mimikatz in the Wild: Bypassing Signature-Based Detections Using the “AK47 of Cyber”

<a id="37557d58c549b4988bf0bb0ada5de975"></a>NTLM

<a id="6c8194db98591f8f68b790975663bc5a"></a>工具

[3097星][5m] [Py] spiderlabs/responder LLMNR/NBT-NS/MDNS投毒，内置HTTP/SMB/MSSQL/FTP/LDAP认证服务器, 支持NTLMv1/NTLMv2/LMv2
[1887星][1m] [Py] lgandx/responder LLMNR, NBT-NS, MDNS 投毒工具，内置 HTTP/SMB/MSSQL/FTP/LDAP 流氓认证服务器，支持 NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP和基础 HTTP认证
[781星][1m] [Py] lgandx/pcredz This tool extracts Credit card numbers, NTLM(DCE-RPC, HTTP, SQL, LDAP, etc), Kerberos (AS-REQ Pre-Auth etype 23), HTTP Basic, SNMP, POP, SMTP, FTP, IMAP, etc from a pcap file or from a live interface.
[744星][1y] [C#] eladshamir/internal-monologue 在不接触LSASS的情况下提取NTLM hash
[676星][1y] [Py] deepzec/bad-pdf create malicious PDF file to steal NTLM(NTLMv1/NTLMv2) Hashes from windows machines
[256星][2m] [Py] evilmog/ntlmv1-multi 修改NTLMv1/NTLMv1-ESS/MSCHAPv1 Hask, 使其可以在hashcat中用DES模式14000破解
[252星][14d] [PS] notmedic/netntlmtosilverticket SpoolSample -> Responder w/NetNTLM Downgrade -> NetNTLMv1 -> NTLM -> Kerberos Silver Ticket
[250星][11d] [Ruby] urbanesec/zackattack Unveiled at DEF CON 20, NTLM Relaying to ALL THE THINGS!

<a id="f07067c1b70f9c002838e2f4ab25da7d"></a>文章

2019.11 [4hou] NTLM 中继攻击的几种非主流玩法
2019.10 [4hou] NTLM攻击两例
2019.09 [pentestlab] Microsoft Exchange – NTLM Relay
2019.08 [vulnerability0lab] Windows 10 Net NTLMv2 Credentials Steal with Excel
2019.06 [freebuf] CVE-2019-1040 Windows NTLM篡改漏洞分析
2019.06 [technicalsyn] Eternalrelayx.py — Non-Admin NTLM Relaying & ETERNALBLUE Exploitation
2019.06 [tencent] Windows NTLM认证(CVE-2019-1040)漏洞预警
2019.06 [4hou] 微软NTLM协议曝出巨大漏洞，现有安全保护措施也无用！
2019.06 [preempt] Security Advisory: Critical Vulnerabilities in NTLM Allow Remote Code Execution and Cloud Resources Compromise
2019.03 [nsfocus] 【M01N】资源约束委派和NTLM Relaying的组合拳接管域内任意主机系统权限
2019.03 [4hou] 结合NTLM中继和Kerberos委派实现域成员机器的提权
2019.03 [venus] 利用 Exchange SSRF 漏洞和 NTLM 中继沦陷域控
2019.03 [knownsec] 利用 Exchange SSRF 漏洞和 NTLM 中继沦陷域控
2019.01 [sans] Relaying Exchange?s NTLM authentication to domain admin (and more)
2019.01 [ironcastle] CERT/CC Reports Microsoft Exchange 2013 and Newer are Vulnerable to NTLM Relay Attacks
2019.01 [evi1cg] Remote NTLM relaying through CS
2019.01 [freebuf] Windows环境中使用Responder获取NTLMv2哈希并利用
2019.01 [4hou] 通过web应用中的文件下载漏洞窃取NTLMv2哈希
2018.12 [hitbsecconf] #HITB2018DXB D2T2: NTLM Relay Is Dead, Long Live NTLM Relay - Jianing Wang and Junyu Zhou
2018.12 [ZeroNights] Jianing Wang, Junyu Zhou - Ntlm Relay Reloaded: Attack methods you do not know

<a id="20f86e3e6a4aa7dc1e5a1e3071e0d500"></a>Kerberos

<a id="fbc6987a538d971f3d85b790fbf0c1e1"></a>工具

[728星][19d] [C#] ghostpack/rubeus 原始Kerberos交互和滥用，C＃编写
[617星][3m] [C] gentilkiwi/kekeo 玩弄 Windows Kerberos 的工具箱
[593星][7m] [Py] nidem/kerberoast 一系列用于攻击MS Kerberos实现的工具
[376星][12d] [Go] jcmturner/gokrb5 Pure Go Kerberos library for clients and services
[354星][2m] [Go] ropnop/kerbrute A tool to perform Kerberos pre-auth bruteforcing
[236星][27d] [Py] dirkjanm/krbrelayx Kerberos unconstrained delegation abuse toolkit

<a id="3a746419a4bc22b8a6425b81b6bd4593"></a>文章

2020.02 [aliyun] 域渗透——Kerberos委派攻击
2020.01 [stealthbits] What is Kerberos Delegation? An Overview of Kerberos Delegation
2020.01 [3gstudent] 渗透技巧——通过Kerberos pre-auth进行用户枚举和口令爆破
2019.10 [4hou] Kerberos中继攻击：滥用无约束委派（下）
2019.09 [4hou] Kerberos中继攻击：滥用无约束委派（上）
2019.07 [4hou] Kerberos 委派攻击原理之 S4U2 利用详解
2019.06 [stealthbits] What is the Kerberos PAC?
2019.05 [andreafortuna] Some thoughts about Kerberos Golden Tickets
2019.05 [improsec] The mind-blowing Kerberos "Use Any Authentication Protocol" Delegation
2019.05 [aliyun] Kerberos Security
2019.03 [freebuf] Kerberos协议探索系列之委派篇
2019.03 [tarlogic] Kerberos (I): How does Kerberos work? – Theory
2019.03 [360] Kerberos协议探索系列之委派篇
2019.03 [ironcastle] Special Webcast: Purple Kerberos: Current attack strategies & defenses – March 11, 2019 1:00pm US/Eastern
2019.03 [freebuf] Kerberos协议探索系列之票据篇
2019.03 [360] Kerberos协议探索系列之票据篇
2019.03 [freebuf] Kerberos协议探索系列之扫描与爆破篇
2019.02 [360] Kerberos协议探索系列之扫描与爆破篇
2019.01 [f5] Troubleshooting Kerberos Constrained Delegation: Strong Encryption Types Allowed for Kerberos
2019.01 [sans] Attacking Kerberos

<a id="2e1fd273eb428694a94396509754acb5"></a>Pass-The-Hash

<a id="3efc90b9ae87a405e231900020ea33ed"></a>工具

<a id="5cbd82fde4af3da6516b88c52d2c357a"></a>文章

2020.01 [aliyun] 深入研究Pass-the-Hash攻击与防御
2019.08 [infosecinstitute] MITRE ATT&CK vulnerability spotlight: Pass-the-hash
2019.04 [4hou] 高级域渗透技术之传递哈希已死-LocalAccountTokenFilterPolicy万岁
2019.03 [freebuf] 如何检测Pass-the-Hash攻击？
2019.03 [tevora] About Windows Process/Thread Tokens and Pass The Hash
2019.02 [stealthbits] How to Detect Overpass-the-Hash Attacks
2019.02 [swordshield] Phantom Users: Deception and Pass the Hash Attacks
2019.02 [swordshield] Phantom Users: Deception and Pass the Hash Attacks
2019.02 [stealthbits] How to Detect Pass-the-Hash Attacks
2018.08 [stealthbits] Deploying Pass-the-Hash Honeypots
2018.07 [stealthbits] 使用蜜罐检测 Pass-the-Hash 攻击
2018.05 [3gstudent] 渗透技巧——Pass the Hash with Remote Desktop
2018.05 [3gstudent] 渗透技巧——Pass the Hash with Remote Desktop
2018.02 [4hou] 如何用WINDOWS事件查看器检测传递哈希
2017.12 [3gstudent] 域渗透——Pass The Hash的实现
2017.12 [3gstudent] 域渗透——Pass The Hash的实现
2017.12 [aliyun] 域渗透——Pass The Hash的实现
2017.08 [labofapenetrationtester] Week of Evading Microsoft ATA - Day 2 - Overpass-the-hash and Golden Ticket
2017.06 [decoder] From Pass-the-Hash to Pass-the-Ticket with no pain
2017.06 [wikidsystems] Defeating pass-the-hash attacks with two-factor authentication

<a id="af48434aafea8db423a9bacef64b1620"></a>Pass-The-Ticket

<a id="e335ccf1622ee0d95b75a4cbb0af5a32"></a>文章

2019.02 [stealthbits] How to Detect Pass-the-Ticket Attacks
2017.05 [4hou] 如何通过SSH隧道实现 Windows Pass the Ticket攻击？
2017.05 [bluescreenofjeff] 如何利用 SSH 隧道进行域渗透（Passthe Ticket）

<a id="fe064b8a783e94169307579efcfc5349"></a>winglogon.exe

<a id="1e77e9449ab3be5cd9977aa55991c897"></a>工具

<a id="6d3a0fcab4e6b1199600072b17f941b0"></a>文章

2020.01 [pentestlab] Persistence – Winlogon Helper DLL
2019.09 [specterops] Understanding and Defending Against Access Token Theft: Finding Alternatives to winlogon.exe
2016.11 [hexacorn] The Archaeologologogology #2 – the romantic view as seen through the winlogon.exe’s window…
2016.05 [malwarebytes] Tech support scammers using Winlogon
2010.11 [redplait] winlogon.exe RPC interfaces
2009.05 [pediy] [推荐]汇编实现注入winlogon.exe屏蔽Ctrl+Alt+Del 附lib库源码和例子

<a id="9813233777717d99ef29e2fe63abfefb"></a>LLMNR

<a id="7658d2242abc5b8c24e80a77b3a89321"></a>工具

[1072星][6m] [PS] kevin-robertson/inveigh Windows PowerShell ADIDNS/LLMNR/mDNS/NBNS spoofer/man-in-the-middle tool
[258星][6m] [C#] kevin-robertson/inveighzero Windows C# LLMNR/mDNS/NBNS/DNS spoofer/man-in-the-middle tool

<a id="e4227d4373c3aec808349a26c979c522"></a>文章

2019.08 [bugbountywriteup] LLMNR Poisoning and WPAD Spoofing
2019.04 [blackhillsinfosec] An SMB Relay Race – How To Exploit LLMNR and SMB Message Signing for Fun and Profit
2018.12 [4hou] 内网渗透技术之超越LLMNR/NBNS欺骗的ADIDNS欺骗攻击
2018.07 [netspi] 不只是 LLMNR/NBNS 欺骗: 攻击集成了 Active Directory 的 DNS
2018.06 [blackhillsinfosec] How to Disable LLMNR & Why You Want To
2018.05 [freebuf] 利用LLMNR结合PDF文件获取PC Hashes
2017.11 [aliyun] 利用 LLMNR 名称解析缺陷劫持内网指定主机会话
2017.04 [n0where] Windows PowerShell LLMNR/NBNS spoofer: Inveigh
2017.03 [n0where] LLMNR NBT-NS MDNS Poisoner: Responder
2017.02 [360] 渗透测试中的LLMNR/NBT-NS欺骗攻击
2017.01 [polaris] LLMNR&WPAD介绍以及渗透测试中的利用
2016.12 [pentest] What is LLMNR & WPAD and How to Abuse Them During Pentest ?
2016.11 [n0where] LLMNR, NBT-NS and MDNS Responder for Windows
2016.06 [] LLMNR and NBT-NS Poisoning Using Responder
2016.03 [360] Inveigh：Windows Powershell版的LLMNR/NBNS 协议欺骗/中间人工具
2016.02 [securityblog] LLMNR NBT-NS and MDNS poisoner
2015.12 [toolswatch] Inveigh Beta Windows PowerShell LLMNR/NBNS Spoofer
2015.09 [gracefulsecurity] Stealing Accounts: LLMNR and NBT-NS Spoofing

<a id="d6fd46f65ce1fe687a92a2da9551d7a9"></a>NetBIOS

<a id="e41f70bc9d7ba0f1430bed63e2d9aece"></a>工具

<a id="ce06393f8c683c74ea341a9ef2b48938"></a>文章

2019.01 [infosecaddicts] Enumerating NetBIOS services
2018.10 [HackerSploit] NetBIOS And SMB Enumeration - Nbtstat & smbclient
2017.09 [hackingarticles] NetBIOS and SMB Penetration Testing on Windows
2016.09 [rapid7] Sonar NetBIOS Name Service Study
2015.10 [akamai] NetBIOS, RPC Portmap and Sentinel Reflection DDoS Attacks
2015.09 [darknet] Remote Network Penetration via NetBios Hack/Hacking
2015.08 [agrrrdog] NetBIOS spoofing for attacks on browser
2014.08 [sans] All Samba 4.x.x are vulnerable to a remote code execution vulnerability in the nmbd NetBIOS name services daemon
2013.04 [securityblog] Disable NetBIOS NULL Sessions
2012.08 [pentestlab] Scanning NetBIOS
2012.08 [freebuf] 使用NetBios Spoofing技术渗透内网
2012.05 [sans] Windows Firewall Bypass Vulnerability and NetBIOS NS
2012.04 [securityblog] NetBIOS name enumeration
2012.01 [sans] Is it time to get rid of NetBIOS?
2011.02 [toolswatch] Netbios Share Scanner updated to v0.3
2011.01 [toolswatch] Netbios Share Scanner v0.2 released
2008.08 [skullsecurity] nbtool 0.02 released! (also, a primer on NetBIOS)

<a id="cd40abc5c7d4b2907b770e53a60ee3ec"></a>其他

<a id="e522f8282206b84cd670cbb658e4bd75"></a>工具

<a id="cbdc1e0b908c8f2df368db8bbc65926f"></a>安全防护

<a id="40fd1488e4a26ebf908f44fdcedd9675"></a>UAC

<a id="02517eda8c2519c564a19219e97d6237"></a>工具

[2500星][2m] [C] hfiref0x/uacme Defeating Windows User Account Control
[2458星][9d] [PS] k8gege/k8tools K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra/Weblogic/Tomcat/Apache/Jboss/DotNetNuke/zabbix)
[1859星][17d] [JS] coreybutler/node-windows Windows support for Node.JS scripts (daemons, eventlog, UAC, etc).
[1742星][1m] [Py] rootm0s/winpwnage UAC bypass, Elevate, Persistence and Execution methods

<a id="90d7d5feb7fd506dc8fd6ee0d7e98285"></a>文章

2020.01 [morphisec] Trickbot Trojan Leveraging a New Windows 10 UAC Bypass
2019.11 [4hou] CVE-2019-1388： Windows UAC权限提升漏洞
2019.10 [freebuf] UAC绕过初探
2019.09 [4sysops] Security options in Windows Server 2016: Accounts and UAC
2019.09 [heynowyouseeme] windows 10 GUI UAC bypass ( netplwiz.exe )
2019.08 [heynowyouseeme] Windows 10 LPE (UAC Bypass) in Windows Store (WSReset.exe)
2019.08 [freebuf] SneakyEXE：一款嵌入式UAC绕过工具
2019.04 [markmotig] Brute Forcing Admin Passwords with UAC
2019.03 [4hou] 通过模拟可信目录绕过UAC的利用分析
2019.03 [aliyun] 如何滥用Access Tokens UIAccess绕过UAC
2019.02 [3gstudent] 通过模拟可信目录绕过UAC的利用分析
2019.02 [3gstudent] 通过模拟可信目录绕过UAC的利用分析
2019.02 [sans] UAC is not all that bad really
2019.01 [fuzzysecurity] Anatomy of UAC Attacks
2019.01 [sevagas] Yet another sdclt UAC bypass
2018.11 [4hou] 利用metasploit绕过UAC的5种方式
2018.11 [tenable] UAC Bypass by Mocking Trusted Directories
2018.10 [0x000x00] How to bypass UAC in newer Windows versions
2018.10 [tyranidslair] Farewell to the Token Stealing UAC Bypass
2018.10 [tyranidslair] Farewell to the Token Stealing UAC Bypass

<a id="184bbacd8b9e08c30cc9ffcee9513f44"></a>AppLocker

<a id="8f1876dff78e80b60d00de25994276d9"></a>工具

[947星][23d] [PS] api0cradle/ultimateapplockerbypasslist The goal of this repository is to document the most common techniques to bypass AppLocker.

<a id="286317d6d7c1a0578d8f5db940201320"></a>文章

2019.11 [tyranidslair] The Internals of AppLocker - Part 4 - Blocking DLL Loading
2019.11 [tyranidslair] The Internals of AppLocker - Part 4 - Blocking DLL Loading
2019.11 [tyranidslair] The Internals of AppLocker - Part 3 - Access Tokens and Access Checking
2019.11 [tyranidslair] The Internals of AppLocker - Part 3 - Access Tokens and Access Checking
2019.11 [tyranidslair] The Internals of AppLocker - Part 2 - Blocking Process Creation
2019.11 [tyranidslair] The Internals of AppLocker - Part 2 - Blocking Process Creation
2019.11 [tyranidslair] The Internals of AppLocker - Part 1 - Overview and Setup
2019.11 [tyranidslair] The Internals of AppLocker - Part 1 - Overview and Setup
2019.09 [blackhillsinfosec] Getting Started With AppLocker
2019.08 [p0w3rsh3ll] How to delete a single Applocker rule
2019.05 [oddvar] A small discovery about AppLocker
2019.04 [4hou] 通过regsrv32.exe绕过Applocker应用程序白名单的多种方法
2019.03 [4sysops] Application whitelisting: Software Restriction Policies vs. AppLocker vs. Windows Defender Application Control
2019.03 [4hou] 逃避手段再开花——从一个能逃避AppLocker和AMSI检测的Office文档讲起
2019.03 [yoroi] The Document that Eluded AppLocker and AMSI
2019.03 [p0w3rsh3ll] Applocker and PowerShell: how do they tightly work together?
2019.02 [4hou] 如何以管理员身份绕过AppLocker
2019.02 [oddvar] Bypassing AppLocker as an admin
2019.01 [hackingarticles] Windows Applocker Policy – A Beginner’s Guide
2019.01 [t00ls] 投稿文章：Bypass Applocker + 免杀执行任意 shellcode [ csc + installUtil ]

<a id="fa89526db1f9373c57ea4ffa1ac8c39f"></a>Data Execution Prevention(DEP)

<a id="10252fd90a09cb32b4e82497aa79f037"></a>工具

<a id="5ff9992a2474eb75e2a1b5860d5b87dc"></a>文章

2019.11 [aliyun] ARM EXP 开发 - 绕过 DEP 执行 mprotect()
2019.07 [codingvision] Bypassing ASLR and DEP - Getting Shells with pwntools
2019.01 [fuzzysecurity] MS13-009 Use-After-Free IE8 (DEP)
2019.01 [fuzzysecurity] BlazeVideo HDTV Player 6.6 Professional SEH&DEP&ASLR
2019.01 [fuzzysecurity] NCMedia Sound Editor Pro v7.5.1 SEH&DEP&ASLR
2019.01 [fuzzysecurity] ALLMediaServer 0.8 SEH&DEP&ASLR
2018.12 [360] CoolPlayer bypass DEP(CVE-2008-3408)分析
2018.09 [duo] Weak Apple DEP Authentication Leaves Enterprises Vulnerable to Social Engineering Attacks and Rogue Devices
2018.09 [3or] ARM Exploitation - Defeating DEP - executing mprotect()
2018.09 [3or] ARM Exploitation - Defeating DEP - execute system()
2018.06 [pediy] [原创]Easy MPEG to DVD Burner 1.7.11 SEH + DEP Bypass Local Buffer Overflow
2018.05 [pediy] [翻译]DEP缓解技术(一)
2017.12 [360] 利用缓解技术：数据执行保护（DEP）
2017.12 [0x00sec] Exploit Mitigation Techniques - Data Execution Prevention (DEP)
2017.10 [freebuf] 在64位系统中使用ROP+Return-to-dl-resolve来绕过ASLR+DEP
2017.10 [freebuf] 如何在32位系统中使用ROP+Return-to-dl来绕过ASLR+DEP
2017.08 [pediy] [原创]利用Ret2Libc挑战DEP——利用ZwSetInformationProcess
2017.06 [360] ropasaurusrex:ROP入门教程——DEP（下）
2017.06 [360] ropasaurusrex:ROP入门教程——DEP（上）
2017.05 [myonlinesecurity] fake clothing order Berhanu (PURCHASE DEPARTMENT) using winace files delivers Loki bot

<a id="edd6035c85e4ddf47939cc0e21505089"></a>Patch Guard(PG)

<a id="928f69b989fa9e8ec3436e361f646eac"></a>工具

[551星][11m] [C] hfiref0x/upgdsed 通用PG和DSE禁用工具

<a id="998ed9d8013051b3c7b21b89d189d509"></a>文章

2019.04 [OffensiveCon] OffensiveCon19 - Luc Reginato - Updated Analysis of PatchGuard on Windows RS4
2019.03 [tetrane] Updated Analysis of PatchGuard on Microsoft Windows 10 RS4
2018.10 [aliyun] 搞定PatchGuard：利用KPTI绕过内核修改保护
2018.10 [ensilo] Melting Down PatchGuard: Leveraging KPTI to Bypass Kernel Patch Protection
2018.09 [pediy] [原创]PatchGuard自效验粗略分析
2015.06 [alex] What are Little PatchGuards Made Of?
2015.01 [ptsecurity] Windows 8.1 Kernel Patch Protection — PatchGuard
2014.07 [mcafee] Malicious Utility Can Defeat Windows PatchGuard
2014.07 [mcafee] Malicious Utility Can Defeat Windows PatchGuard
2014.03 [mcafee] Analyzing the Uroburos PatchGuard Bypass
2014.03 [mcafee] Analyzing the Uroburos PatchGuard Bypass
2013.02 [pediy] [原创]DisablePatchGuard.sys
2012.11 [pediy] [讨论]让PatchGuard变狗屎的那些方法~
2011.06 [picturoku] Patchguard red flags
2009.12 [immunityinc] PatchGuard
2007.01 [alex] Windows Vista 64-bit Driver Signing/PatchGuard Workaround
2007.01 [pediy] [转帖]Bypassing PatchGuard on Windows x64
2006.10 [microsoft] The Final Word – Jim Allchin Letter Clarifies Patchguard on Vista
2006.10 [infosecblog] MS caves on Vista Patchguard? Not so fast
2006.08 [microsoft] Interview with Patchguard Architect Forrest Foltz (Windows Vista x64 Security – Patchguard follow up)

<a id="9820fc65cd69d9d295a81cfd90be12fe"></a>Driver Signature Enforcement(DSE)

<a id="18cbac58652453abbe2ff1aed187d370"></a>工具

[723星][10m] [C] hfiref0x/tdl Driver loader for bypassing Windows x64 Driver Signature Enforcement
[369星][11d] [C] mattiwatti/efiguard Disable PatchGuard and DSE at boot time
[322星][5m] [C] 9176324/shark Turn off PatchGuard in real time for win7 (7600) ~ win10 (18950).
[274星][9d] [C++] can1357/byepg Defeating Patchguard universally for Windows 8, Windows 8.1 and all versions of Windows 10 regardless of HVCI

<a id="b2d4a9c239c773d20bd4363a4a4c5d83"></a>文章

2014.05 [pediy] [分享]抄抄改改过win7,win8,win8.1 x64的强制签名(DSE)
2013.01 [colinpoflynn] Windows 7 64-bit Disable Driver Signature Enforcement
2012.12 [vexillium] Defeating Windows Driver Signature Enforcement #3: The Ultimate Encounter
2012.12 [vexillium] Defeating Windows Driver Signature Enforcement #3: The Ultimate Encounter
2012.11 [vexillium] Defeating Windows Driver Signature Enforcement #2: CSRSS and thread desktops
2012.11 [vexillium] Defeating Windows Driver Signature Enforcement #2: CSRSS and thread desktops
2012.11 [vexillium] Defeating Windows Driver Signature Enforcement #1: default drivers
2012.11 [vexillium] Defeating Windows Driver Signature Enforcement #1: default drivers
2010.06 [vexillium] A quick insight into the Driver Signature Enforcement
2010.06 [vexillium] A quick insight into the Driver Signature Enforcement
2006.03 [] Showdown: MIIS vs. DSE

<a id="000972b0f2afd58a699bdceabfc21249"></a>Windows Defender

<a id="3296552ba5a3a76e4e1b1c0e1164adde"></a>工具

[424星][10d] [C#] matterpreter/defendercheck Identifies the bytes that Microsoft Defender flags on.

<a id="a61cee92890da1a569289b5c1daafb6e"></a>文章

2020.02 [eforensicsmag] [CQLabs] Windows Defender Exploit Guard under the hood |by Artur Wojtkowski
2019.12 [p0w3rsh3ll] Quick post: Review Windows Defender notifications
2019.12 [4hou] 评估一个新的安全数据源的有效性: Windows Defender 漏洞利用防护（上）
2019.12 [Enderman] Can Windows Defender protect your computer against malware?
2019.12 [illuminati] Starlink: “Sorry this application cannot run in a Virtual Machine” while running with Windows Defender Application Guard enabled.
2019.11 [vishal] Disable Defender in Win10
2019.10 [palantir] Assessing the effectiveness of a new security data source: Windows Defender Exploit Guard
2019.10 [HackersOnBoard] Windows Offender Reverse Engineering Windows Defender's Antivirus Emulator
2019.09 [ATTTechChannel] 9/13/19 GootKit Malware Bypasses Windows Defender | AT&T ThreatTraq
2019.09 [aliyun] Playing with Windows Defender
2019.07 [microsoft] How Windows Defender Antivirus integrates hardware-based system integrity for informed, extensive endpoint protection
2019.06 [goet] Analyzing your Microsoft Defender ATP data in real-time in ELK using the new streaming API
2019.06 [goet] Protect yourself against #BlueKeep using Azure Sentinel and Defender ATP.
2019.05 [eli] Using PowerShell in Windows Defender
2019.05 [morphisec] Morphisec + WINDOWS Defender AV: Advanced Threat Protection Made Easy
2019.04 [contextis] Windows Defender Functionality
2019.04 [rce4fun] Circumventing Windows Defender ATP's user-mode APC Injection sensor from Kernel-mode
2019.03 [freebuf] 良心开发者，微软安全防护套件Windows Defender ATP将登陆Mac OS平台
2019.03 [4hou] 攻击者如何使用修改后的Empire绕过Windows Defender
2019.03 [freebuf] 修改Empire绕过Windows Defender

<a id="04b9831a450074392140722cd14df668"></a>Antimalware Scan Interface(AMSI)

<a id="93e309abead4f559486dc29f539869de"></a>工具

[322星][9d] [C#] hackplayers/salsa-tools Salsa Tools - ShellReverse TCP/UDP/ICMP/DNS/SSL/BINDTCP/Shellcode/SILENTTRINITY and AV bypass, AMSI patched

<a id="15a5d4f48f2cd80986bd504c561d4a89"></a>文章

2020.01 [ionize] Detecting AMSI Bypass
2019.11 [two06] AMSI as a Service — Automating AV Evasion
2019.11 [thecyberbutler] Yet another update to bypass AMSI in VBA
2019.11 [freebuf] 如何识别并分析反恶意软件扫描接口(AMSI)组件
2019.10 [binarydefense] Binary Defense MDR Integrates Microsoft Antimalware Scan Interface Interoperability (AMSI) - Binary Defense
2019.10 [mattifestation] Antimalware Scan Interface Detection Optics Analysis Methodology: Identification and Analysis of AMSI for WMI
2019.10 [4hou] 看我如何一步步将基于堆的 AMSI 绕过做到接近完美
2019.10 [specterops] Antimalware Scan Interface Detection Optics Analysis Methodology
2019.09 [byte] Adventures in the Wonderful World of AMSI.
2019.08 [4hou] 绕过AMSI的全套操作过程
2019.08 [mcafee] McAfee AMSI Integration Protects Against Malicious Scripts
2019.08 [mcafee] McAfee AMSI Integration Protects Against Malicious Scripts
2019.07 [codewhitesec] Heap-based AMSI bypass for MS Excel VBA and others
2019.07 [f] Hunting for AMSI bypasses
2019.06 [360] 如何绕过AMSI
2019.06 [contextis] AMSI Bypass
2019.06 [aliyun] How Red Teams Bypass AMSI and WLDP for .NET Dynamic Code
2019.06 [360] 如何绕过AMSI及WLDP
2019.05 [benoit] Alternative AMSI bypass
2019.04 [4hou] 如何绕过AMSI for VBA

<a id="b1324e23dc1b1314c3674203af4cb147"></a>Address Space Layout Randomization(ASLR)

<a id="92a9071fd688be4888c2fbd493ae2d26"></a>工具

[901星][2m] [Roff] slimm609/checksec.sh 检查可执行文件(PIE, RELRO, PaX, Canaries, ASLR, Fortify Source)属性的 bash 脚本
[371星][12d] [PS] netspi/pesecurity 检查PE(EXE/DLL)编译选项是否有：ASLR, DEP, SafeSEH, StrongNaming, Authenticode。PowerShell模块

<a id="530581a7d5ef7c27b168a7f86ff642af"></a>文章

2019.12 [johnlatwc] Early Security Stories — ASLR
2019.10 [HackersOnBoard] Black Hat USA 2016 Breaking Kernel Address Space Layout Randomization KASLR With Intel TSX
2019.06 [arxiv] [1906.10478] From IP ID to Device ID and KASLR Bypass (Extended Version)
2019.06 [securityevaluators] ASUSWRT RCE via Buffer Overflow, ASLR Bypass
2019.06 [openanalysis] Disable ASLR for Easier Malware Debugging With x64dbg and IDA Pro
2019.06 [OALabs] Disable ASLR For Easier Malware Debugging With x64dbg and IDA Pro
2019.04 [4hou] 利用ASLR薄弱点：Chrome沙箱逃逸漏洞分析
2019.03 [offensive] Development of a new Windows 10 KASLR Bypass (in One WinDBG Command)
2019.03 [notsoshant] Windows Exploitation: ASLR Bypass (MS07–017)
2019.02 [rce4fun] VirtualProtectEx to bypass ASLR : A specific case study
2019.01 [aliyun] 静态链接可执行文件的ASLR保护机制
2018.11 [pediy] [原创] CVE-2014-0322 IE与Flash结合利用绕过ASLR+DEP
2018.11 [pediy] [原创]CVE-2012-1889 Win7 通过GUID加载dll库绕过ASLR+DEP
2018.11 [securityevaluators] ASUSWRT Buffer Overflow, Format String ASLR Bypass
2018.10 [osandamalith] PE Sec Info – A Simple Tool to Manipulate ASLR and DEP Flags
2018.08 [cmu] When "ASLR" Is Not Really ASLR - The Case of Incorrect Assumptions and Bad Defaults
2018.06 [teamultimate] Return to PLT, GOT to bypass ASLR remotely
2018.06 [teamultimate] Format String Exploits: Defeating Stack Canary, NX and ASLR Remotely on 64 bit
2018.06 [nul] Linux ASLR的一些实验（1）
2018.05 [pediy] [翻译]绕过 ASLR + NX 第一部分

<a id="6fc6d2a82e58d5a0daa258dd87190fe5"></a>Control Flow Guard

<a id="5e156e74fbac1a857251ad7349fa55fe"></a>工具

<a id="87d619895642fc563b2b31154ade189a"></a>Control Integrity Guard

<a id="d1798993715e3e3a240884b7ff04b45d"></a>其他

<a id="7571369f732a6a16dfe727626709f702"></a>MS1X

<a id="a00506bcb946ba1c14c0747407dd2570"></a>工具

[345星][4m] [Py] 3ndg4me/autoblue-ms17-010 This is just an semi-automated fully working, no-bs, non-metasploit version of the public exploit code for MS17-010
[254星][17d] [Py] mez-0/ms17-010-python MS17-010: Python and Meterpreter

<a id="e08e4392157e48200f68d6e16e31c524"></a>文章

2020.02 [LoiLiangYang] Exploiting Windows 10 with MS17_010_PSEXEC
2010.04 [g] MS10-020
2010.04 [sans] MS10-021: Encountering A Failed WinXP Update
2010.03 [sans] OOB Update for Internet Explorer MS10-018
2010.02 [sans] MS10-015 may cause Windows XP to blue screen (but only if you have malware on it)
2010.02 [g] More details on MS10-006
1970.01 [] [MS15-010 / CVE-2015-0057] Exploitation

<a id="73aa875eba0a61328cda48b6d2b96135"></a>系统机制

<a id="d8eb297358353fd465b9b6914327fc0c"></a>RDP

<a id="f8078be0204bcc6c4b88b389d5e169d7"></a>工具

[6407星][1y] [Pascal] stascorp/rdpwrap RDP Wrapper Library
[3800星][9d] [C] freerdp/freerdp FreeRDP is a free remote desktop protocol library and clients
[1655星][21d] [C] neutrinolabs/xrdp xrdp: an open source RDP server
[1083星][9d] [C] zerosum0x0/cve-2019-0708 Scanner PoC for CVE-2019-0708 RDP RCE vuln
[996星][1m] [Py] syss-research/seth Perform a MitM attack and extract clear text credentials from RDP connections
[911星][13d] [Py] jimmy201602/webterminal ssh rdp vnc telnet sftp bastion/jump web putty xshell terminal jumpserver audit realtime monitor rz/sz 堡垒机云桌面 linux devops sftp websocket file management rz/sz otp 自动化运维审计录像文件管理 sftp上传实时监控录像回放网页版rz/sz上传下载/动态口令 django
[764星][10d] [C] rdesktop/rdesktop rdesktop is an open source UNIX client for connecting to Windows Remote Desktop Services, capably of natively speaking Remote Desktop Protocol (RDP) in order to present the user's Windows desktop. rdesktop is known to work with Windows server version ranging from NT 4 terminal server to Windows 2012 R2.
[692星][13d] [C] robertdavidgraham/rdpscan A quick scanner for the CVE-2019-0708 "BlueKeep" vulnerability.
[433星][9d] [C++] 0x09al/rdpthief Extracting Clear Text Passwords from mstsc.exe using API Hooking.
[378星][15d] [C#] beckzhu/simpleremote 远程管理工具。轻量级、选项卡式、免费、开源的远程连接管理工具，支持RDP、SSH、Telnet协议
[376星][13d] [Py] gosecure/pyrdp RDP man-in-the-middle (mitm) and library for Python 3 with the ability to watch connections live or after the fact
[339星][21d] [PS] joelgmsec/autordpwn The Shadow Attack Framework
[296星][9d] [Py] xfreed0m/rdpassspray Python3 tool to perform password spraying using RDP
[283星][8m] [Py] k8gege/cve-2019-0708 3389远程桌面代码执行漏洞CVE-2019-0708批量检测工具(Rdpscan Bluekeep Check)

<a id="789aa51ac9d9c559e587cbd6ae85af8a"></a>文章

2019.05 [fortinet] CVE-2019-0708 – Remote Desktop Protocol and Remote Code Execution #Bluekeep
2018.07 [mcafee] Organizations Leave Backdoors Open to Cheap Remote Desktop Protocol Attacks
2018.04 [fireeye] Establishing a Baseline for Remote Desktop Protocol
2017.12 [blackmoreops] Hacking remote desktop protocol using rdpy
2017.11 [esecurityplanet] Flood of Attacks Spread Ransomware via Remote Desktop Protocol
2017.03 [4hou] 如何悄无声息的对RDP和远程会话进行劫持？
2017.03 [korznikov] Windows全平台会话劫持
2017.02 [trendmicro] Brute Force RDP Attacks Plant CRYSIS Ransomware
2016.12 [sensepost] XRDP: Exploiting Unauthenticated X Windows Sessions
2016.11 [digi] Windows RDP client, show login page
2016.11 [webroot] RDP Attacks: What You Need to Know and How to Protect Yourself
2016.11 [whereisk0shl] Cain RDP缓冲区溢出漏洞（CVE-2008-5405）
2016.08 [id] Anti-1C, RDP-WinRAR
2016.07 [freebuf] RDP连接降级攻击以及规避方法解析
2016.06 [duo] Protecting Remote Access to Your Computer: RDP Attacks and Server Credentials for Sale
2016.05 [willgenovese] SSH Tunneling RDP Using Putty
2016.05 [fox] Ransomware deployments after brute force RDP attack
2016.04 [portcullis] Downgrading RDP connections and how to avoid it
2016.04 [contextis] RDP Replay Code Release
2016.01 [securestate] Scripting RDP for Pillaging and Potato

<a id="4ece6a5ac5b1176456fe44100a8b18d7"></a>文章_0

2019.12 [welivesecurity] It’s time to disconnect RDP from the internet | WeLiveSecurity
2019.12 [4hou] 预警！Windows BlueKeep RDP来了！
2019.12 [talosintelligence] Microsoft Remote Desktop Services (RDP8) license negotiation denial-of-service vulnerability
2019.12 [talosintelligence] Microsoft Remote Desktop Services (RDP7) Windows XP Multiple Information Leak Vulnerabilities
2019.12 [talosintelligence] Vulnerability Spotlight: Two vulnerabilities in RDP for Windows 7, XP
2019.12 [4hou] Reverse RDP攻击：Hyper-V Connection
2019.11 [freebuf] RDP远程漏洞（CVE-2019-0708）被发现野外利用来挖矿
2019.11 [venus] 通过RDP反向攻击mstsc
2019.11 [rapid7] Securing RDP Vulnerabilities: Learnings from Bluekeep and DejaBlue
2019.11 [fortinet] BlueKeep RDP Attacks are Starting – Patch CVE-2019-0708 Now
2019.09 [venus] RDP 登录日志取证与清除
2019.09 [aliyun] RDP登录日志取证与清除
2019.09 [webroot] Cyber News Rundown: TFlower Ransomware Exploiting RDP
2019.09 [freebuf] Seth：执行MitM攻击并从RDP连接中提取明文凭证
2019.09 [hakin9] PyRDP - Python 3 Remote Desktop Protocol (RDP) Man-in-the-Middle (MITM) and library
2019.09 [4hou] RDP漏洞或引发大规模蠕虫爆发，用户可用阿里云免费检测服务，请尽快修复
2019.09 [4sysops] Azure Redeploy: If RDP or application access to an Azure VM fails
2019.09 [tencent] 腾讯安全发布高危预警：Crysis勒索病毒利用RDP爆破攻击加剧
2019.08 [malwaretech] DejaBlue: Analyzing a RDP Heap Overflow
2019.08 [freebuf] 微软RDP远程代码执行漏洞（CVE-2019-0708）分析集锦

<a id="2ccd7ff9d95435e841f8c667dda1338e"></a>SMB

<a id="1d122fd6dda9ebbd4ee460facbaf1d4d"></a>工具

[1215星][1m] [C#] k8gege/ladon 用于大型网络渗透的多线程插件化综合扫描神器
[820星][1y] [PS] kevin-robertson/invoke-thehash 执行 pass the hash WMI 和 SMB 任务的PowerShell函数
[767星][2m] [Py] shawndevans/smbmap SMB枚举
[388星][12d] [C] zerosum0x0/smbdoor Windows kernel backdoor via registering a malicious SMB handler
[355星][3m] [Py] m8r0wn/nullinux SMB null 会话识别和枚举工具
[348星][11m] [Py] skorov/ridrelay 通过使用具有低priv的SMB中继来枚举您没有信誉的域上的用户名。
[322星][8m] [C#] raikia/credninja A multithreaded tool designed to identify if credentials are valid, invalid, or local admin valid credentials within a network at-scale via SMB, plus now with a user hunter
[255星][19d] [PS] p3nt4/invoke-piper Forward local or remote tcp ports through SMB pipes.
[225星][3m] [Py] m4ll0k/smbrute SMB Protocol Bruteforce
[210星][3m] [Py] miketeo/pysmb pysmb is an experimental SMB/CIFS library written in Python. It implements the client-side SMB/CIFS protocol (SMB1 and SMB2) which allows your Python application to access and transfer files to/from SMB/CIFS shared folders like your Windows file sharing and Samba folders.

<a id="3832aa4bcf779dc33fed9dcd71129a59"></a>文章

2013.12 [trendmicro] FBI details major trends in cyber attacks against SMB’s
2013.11 [sophos] Ponemon Institute: Management uncertainty, lack of security expertise put SMBs at risk
2013.10 [thomasmaurer] EMC – SMB 3.0 is the Future of Storage
2013.07 [pediy] [原创]实验：SMB抓包破解windows登陆密码
2013.06 [microsoft] Cloud Trust Study: Top of the hill Security, Privacy and Reliability benefits for SMBs in Germany
2013.06 [intercepter] Актуальность атаки SMBRelay в современных Windows сетях
2013.06 [microsoft] Cloud Trust Study: SMBs in France echo Security, Privacy and Reliability Benefits of Cloud Computing
2013.06 [microsoft] Blue Skies in London: Cloud Security, Privacy and Reliability Perceptions of SMBs in the U.K
2013.04 [microsoft] SMB CTO Reports on Security Management and Green IT with the Cloud
2013.01 [trendmicro] 2013 Security Predictions: What Should Small and Medium Businesses (SMB) Look Out For?
2013.01 [trendmicro] Securing Your First Server: What SMBs Need to Know
2012.12 [netspi] Executing SMB Relay Attacks via SQL Server using Metasploit
2012.12 [bogner] SMBX: Where is my smb.conf
2012.12 [trendmicro] Mobile Security for the SMB: Mac vs. Android Threats
2012.11 [] SMB ATTACK 绕过安全软件的访问
2012.10 [trendmicro] How the Cloud is Affecting SMB Channel Partners
2012.08 [welivesecurity] The Cloud for SMBs: 7 tips for safer cloud computing
2012.06 [freebuf] 利用Metasploit进行SMB版本的扫描
2012.05 [microsoft] Cloud Security Benefits for SMBs in Hong Kong
2012.05 [microsoft] Cloud Security Benefits for SMBs in Asia

<a id="25c0e7fba8e6523c9e60eaea718db391"></a>Windows Management Instrumentation(WMI)

<a id="a44289a4715b50988ac7cbfc1fca0a92"></a>工具

[708星][12d] [Go] martinlindhe/wmi_exporter Prometheus exporter for Windows machines using WMI
[706星][1y] [PS] arvanaghi/sessiongopher 使用WMI为远程访问工具（如WinSCP，PuTTY，SuperPuTTY，FileZilla和Microsoft远程桌面）提取保存的会话信息。PowerShell编写
[610星][1y] [PS] fortynorthsecurity/wmimplant This is a PowerShell based tool that is designed to act like a RAT. Its interface is that of a shell where any command that is supported is translated into a WMI-equivalent for use on a network/remote machine. WMImplant is WMI based.
[265星][9d] [JS] pandorafms/pandorafms Pandora FMS is a flexible and highly scalable monitoring system ready for big environments. It uses agents (Linux, Windows, AIX, HP-UX, Solaris and BSD systems) and can do both local and remote network monitoring (SNMP v3, TCP checks, WMI, etc).
[259星][1m] [Go] stackexchange/wmi WMI for Go
[251星][1y] [C#] 0xbadjuju/wheresmyimplant A Bring Your Own Land Toolkit that Doubles as a WMI Provider

<a id="78882a933dbf22785891fe26ea95feb1"></a>文章

2020.02 [darkoperator] Getting DNS Client Cached Entries with CIM/WMI
2020.01 [pentestlab] Persistence – WMI Event Subscription
2019.12 [randomascii] O(n^2), again, now in WMI
2019.11 [4hou] 新型入侵技术：使用WMI编译的“.bmf”文件和CertUtil进行混淆执行
2019.10 [4hou] 反恶意软件扫描接口检测分析方法论: 用于 WMI 的 AMSI 识别与分析
2019.09 [4hou] GhostMiner：无文件加密货币挖矿机武器化WMI对象
2019.09 [trendmicro] Fileless Cryptocurrency-Miner GhostMiner Weaponizes WMI Objects, Kills Other Cryptocurrency-Mining Payloads
2019.06 [lazywinadmin] PowerShell - Joining WMI Classes in a query
2019.05 [mdsec] Persistence: “the continued or prolonged existence of something”: Part 3 – WMI Event Subscription
2019.04 [carbonblack] CB TAU Threat Intelligence Notification: Emotet Utilizing WMI to Launch PowerShell Encoded Code
2019.04 [rsa] Detecting Lateral Movement in RSA NetWitness: WMI
2019.03 [robtlee73] Investigating WMI Attacks
2019.03 [ironcastle] Special Webcast: Investigating WMI Attacks – March 7, 2019 3:30pm US/Eastern
2019.02 [sans] Investigating WMI Attacks
2019.01 [fuzzysecurity] wmic_info.bat
2019.01 [hackingarticles] Bypass Application Whitelisting using wmic.exe (Multiple Methods)
2019.01 [4hou] 如何检测并清除WMI持久化后门
2019.01 [sans] Theres Something About WMI
2019.01 [sans] There's Something About WMI
2019.01 [sans] SIEMple Simon Met a WMIman

<a id="ac43a3ce5a889d8b18cf22acb6c31a72"></a>Event Tracing for Windows(ETW)

<a id="0af4bd8ca0fd27c9381a2d1fa8b71a1f"></a>工具

[1303星][12d] [JS] jpcertcc/logontracer 通过可视化和分析Windows事件日志来调查恶意的Windows登录
[885星][16d] [C++] google/uiforetw User interface for recording and managing ETW traces
[673星][12m] [Roff] palantir/windows-event-forwarding 使用 Windows 事件转发实现网络事件监测和防御
[655星][9d] [PS] sbousseaden/evtx-attack-samples 与特定攻击和利用后渗透技术相关的Windows事件样例
[566星][30d] [PS] sans-blue-team/deepbluecli a PowerShell Module for Threat Hunting via Windows Event Logs
[505星][11m] [C#] lowleveldesign/wtrace Command line tracing tool for Windows, based on ETW.
[466星][15d] [PS] nsacyber/event-forwarding-guidance 帮助管理员使用Windows事件转发（WEF）收集与安全相关的Windows事件日志
[401星][12m] [Py] williballenthin/python-evtx 纯Python编写的Windows事件日志解析器
[318星][3m] [C#] zodiacon/procmonx 通过Windows事件日志获取与Process Monitor显示的相同的信息，无需内核驱动
[295星][11d] [C#] fireeye/silketw flexible C# wrappers for ETW
[290星][12m] [C#] nsacyber/windows-event-log-messages 检索Windows二进制文件中嵌入的Windows事件日志消息的定义，并以discoverable的格式提供它们
[268星][5m] [C++] gametechdev/presentmon Tool for collection and processing of ETW events related to DXGI presentation.
[261星][10d] [C++] microsoft/krabsetw KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.

<a id="11c4c804569626c1eb02140ba557bb85"></a>文章

2020.02 [vanimpe] Parse stored Windows Event logs with Security Onion
2020.01 [X13Cubed] CVEs in Windows Event Logs? What You Need to Know
2020.01 [randomascii] Bulk ETW Trace Analysis in C#
2019.12 [Cooper] EventList, Matching Windows Event Log IDs With MITRE ATT&CK - Miriam Wiesner
2019.09 [adventuresincyberchallenges] Powershell Encoded Payload In Clear Text in Windows Event Log 4688
2019.09 [Cyb3rWard0g] Threat Hunting with ETW events and HELK — Part 2: Shipping ETW events to HELK ⚒
2019.09 [Cyb3rWard0g] Threat Hunting with ETW events and HELK — Part 1: Installing SilkETW 🏄‍♀🏄
2019.06 [fox] Export corrupts Windows Event Log files
2019.05 [freebuf] SilkETW：一款针对Windows事件追踪的自定义C#封装工具
2019.04 [4sysops] Forward Windows events to a Syslog server with free SolarWinds Event Log Forwarder for Windows
2019.02 [360] ETW注册表监控windows内核实现原理
2019.01 [sans] Rocking Your Windows EventID with ELK Stack
2019.01 [sans] Threat Hunting via Windows Event Logs
2019.01 [sans] Hunting for Lateral Movement Using Windows Event Log
2018.12 [palantir] Tampering with Windows Event Tracing: Background, Offense, and Defense
2018.12 [sophos] Hunting for threats with Intercept X and the Windows Event Collector
2018.08 [4sysops] Query multiple Windows event logs with PowerShell
2018.07 [criteo] Grab ETW Session, Providers and Events
2018.07 [3gstudent] Windows Event Viewer Log (EVT)单条日志清除（三）——删除当前系统指定指定时间段evt日志记录
2018.07 [3gstudent] Windows Event Viewer Log (EVT)单条日志清除（三）——删除当前系统指定指定时间段evt日志记录

<a id="fe0ba7bd911de751b4cc28c9e1a6cb28"></a>Lsass

<a id="94693a3207198ec3c995deb0f38cc22c"></a>工具

[489星][20d] [Py] hackndo/lsassy Extract credentials from lsass remotely
[356星][11d] [Py] aas-n/spraykatz Credentials gathering tool automating remote procdump and parse of lsass process.
[315星][13d] [C] outflanknl/dumpert LSASS memory dumper using direct system calls and API unhooking.

<a id="b8904d923ae77cf3c230ee1e07717572"></a>文章

2020.02 [freebuf] Lsassy：如何远程从lsaas中提取用户凭证
2020.01 [rsa] Using RSA NetWitness to Detect Credential Harvesting: lsassy
2019.12 [jimwilbur] Defender Quarantines Lsass Dumps
2019.12 [4hou] 绕过WDATP获取LSASS进程数据
2019.07 [markmotig] Some ways to dump LSASS.exe
2019.05 [osandamalith] Shellcode to Dump the Lsass Process
2019.01 [astr0baby] AndrewSpecial – stealthy lsass.exe memory dumping
2018.01 [stealthbits] Market Trends: Announcing StealthINTERCEPT 5.0 General Availability – With Enterprise Password Enforcer & LSASS Guardian™
2017.10 [360] 绕过LSASS的SACL审计
2017.10 [tyranidslair] Bypassing SACL Auditing on LSASS
2017.10 [tyranidslair] Bypassing SACL Auditing on LSASS
2017.01 [360] MS16-137：LSASS远程拒绝服务漏洞分析
2016.11 [g] MS16-137: LSASS Remote Memory Corruption Advisory
2016.02 [govolution] Memdumps, Volatility, Mimikatz, VMs – Part 1: Mimikatz & lsass.exe Dump
2011.12 [pentestmonkey] mimikatz: Tool To Recover Cleartext Passwords From Lsass
2008.03 [pediy] [原创]磁碟机病毒(com\lsass.exe、smss.exe、dnsq.dll)新变种之anti方式及感染EXE文件方式跟踪
2006.09 [sans] CA eTrust Antivirus [was] flagging lsass.e x e
2005.03 [sans] Yahoo Messenger worm?; exploited.lsass.cc bot traffic
2004.05 [sans] -UPDATE- Sasser Worm , Week in Review; LSASS Exploit Analysis; SANSFIRE 2004
2004.04 [sans] PhatBot exploiting LSASS?

<a id="5aa94d550d4ead20c77cb4c609378a40"></a>BitLocker

<a id="624af4702d96b0df8f89e6142815f034"></a>工具

[772星][3m] [C] aorimn/dislocker FUSE driver to read/write Windows' BitLocker-ed volumes under Linux / Mac OSX
[347星][1y] [C] e-ago/bitcracker BitLocker密码破解器

<a id="734243fcb4f539b563072a725e24b75f"></a>文章

2020.01 [4sysops] Store and Retrieve BitLocker Recovery Keys from Active Directory
2019.10 [4sysops] Specops Key Recovery: Self-service for unlocking BitLocker-encrypted devices
2019.09 [codeinsecurity] Recovering BitLocker when the BCD has been modified
2019.06 [security] [PL] Co to jest BitLocker oraz TPM? Jak działa szyfrowanie dysków?
2019.06 [KacperSzurek] Co to jest BitLocker oraz TPM? Jak działa szyfrowanie dysków?
2019.04 [4hou] 如何从TPM中提取BitLocker私钥
2019.02 [4sysops] Find BitLocker recovery passwords in Active Directory with PowerShell
2019.01 [arxiv] [1901.01337] BitCracker: BitLocker meets GPUs
2018.12 [360] 基于Win7的Bitlocker加密分析及实战思路
2018.11 [contextis] Hardware Encryption Weaknesses and BitLocker
2018.11 [contextis] Hardware Encryption Weaknesses and BitLocker
2018.05 [irq5] Crypto-Erasing BitLocker Drives
2018.04 [NetworkHeros] How to Recover BitLocker Corrupted Drive (100% Guarantee)
2018.01 [elcomsoft] How to Instantly Access BitLocker, TrueCrypt, PGP and FileVault 2 Volumes
2017.10 [deepsec] DeepSec 2017 Talk: BitCracker – BitLocker Meets GPUs – Elena Agostini
2017.09 [n0where] Open Source BitLocker Password Cracking Tool: BitCracker
2017.09 [4hou] “密码找回”功能暗藏杀机，可绕过Windows auth &BitLocker
2017.09 [freebuf] 利用忘记密码功能绕过Windows auth & BitLocker
2017.09 [gameofpwnz] Dislocker USB with Bitlocker (LAB)
2017.09 [gameofpwnz] Dislocker: Recovering Data from Drive with BitLocker – Requires Bitlocker Recovery Key or Password

<a id="645dbf50d2f476c438e48af8c9bcd78c"></a>NTFS

<a id="64624c6440889198d1c69ab40f1a5cf3"></a>工具

[582星][1y] mtivadar/windows10_ntfs_crash_dos Windows NTFS文件系统崩溃漏洞PoC
[270星][17d] [Py] dkovar/analyzemft fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple format
[234星][21d] [C] pbatard/uefi-ntfs UEFI:NTFS - Boot NTFS partitions from UEFI

<a id="a976da792a1490b26da931174e05ee8f"></a>文章

2019.08 [X13Cubed] NTFS Journal Forensics
2019.03 [4sysops] FolderSecurityViewer: Analyze and report on effective NTFS permissions
2019.03 [4hou] Windows NTFS文件系统目录大小写敏感导致的安全问题
2019.02 [4hou] 渗透技巧——Windows下NTFS文件的USN Journal
2019.02 [tyranidslair] NTFS Case Sensitivity on Windows
2019.02 [tyranidslair] NTFS Case Sensitivity on Windows
2019.01 [4hou] 渗透技巧——Windows下NTFS文件的时间属性
2019.01 [3gstudent] 渗透技巧——Windows下NTFS文件的USN Journal
2019.01 [3gstudent] 渗透技巧——Windows下NTFS文件的USN Journal
2019.01 [sans] Forgotten but Not Gone: Gathering NTFS Artifacts of Detection
2019.01 [sans] Forgotten But Not Gone: Gathering NTFS Artifacts of Deletion
2018.12 [3gstudent] 渗透技巧——Windows下NTFS文件的时间属性
2018.12 [3gstudent] 渗透技巧——Windows下NTFS文件的时间属性
2018.10 [osr] NTFS Status Debugging
2018.09 [] NTFS Object IDs in EnCase – Part 3
2018.09 [] NTFS Object IDs in X-Ways
2018.09 [] NTFS Object IDs in EnCase – Part 2
2018.09 [] NTFS Object IDs in EnCase
2018.09 [secjuice] Hiding In Plain Sight With NTFS Steganography
2018.08 [pediy] [翻译]渗透测试的WINDOWS NTFS技巧集合

<a id="b16c5b961088f60a61567d28844e9224"></a>SSDT

<a id="59abc34487b51ce7a5383d3f37308eac"></a>工具

<a id="6d2a886ff4abcae02d0968c17d4adfe2"></a>文章

2018.12 [pediy] [原创]过用户层HOOK 驱动层SSDT HOOK (之进程保护篇）
2018.11 [pediy] [分享][原创]Win7 x86 SSDT Inline Hook
2018.04 [pediy] [原创]ROOTKIT 核心技术——利用 NT!_MDL（内存描述符链表）突破 SSDT（系统服务描述符表）的只读访问限制 PART I
2017.05 [pediy] [分享]发布一个遍历shadowssdt函数名_驱动源码
2016.05 [pediy] [原创]关于Win7 x64 Shadow SSDT 的探索和 Inline HOOK
2015.12 [insinuator] Investigating Memory Analysis Tools – SSDT Hooking via Pointer Replacement
2015.09 [pediy] [原创]旧代码分享：绕过卡巴斯基主动防御，加载驱动，unhook所有SSDT&Shadow SSDT
2015.09 [pediy] 原创普及X64 ssdtshadow inline HOOK
2015.08 [lightless] 基于SSDT的注册表主防系统
2015.06 [pediy] [原创]发个xp~win10_x86/x64全兼容的ShadowSSDT获取函数
2015.05 [pediy] [原创]SSDT InlineHook学习笔记
2014.05 [pediy] [分享]新手学内核第二篇 Shadow SSDT
2013.12 [pediy] [原创]SSDT Hook 详细过程
2013.12 [pediy] [原创]Win8 32位中SSDT Shadow Hook的实现方法
2013.08 [pediy] [原创]浅谈系列之-Add New SSDT 长夜漫漫-看流星
2013.08 [pediy] [原创]Win32Asm 驱动学习笔记《 HOOK SSDT》
2013.08 [pediy] [原创]新手学ssdt_hook
2013.06 [pediy] [原创]一份简单的内核通用HOOK 带使用例子(带简单SSDT恢复)~
2013.04 [pediy] [原创]简单调用任意未导出SSDT函数方法
2012.07 [pediy] [原创]汇编与驱动-绕过SSDT保护进程

<a id="23d474a347ac76b1ba3a1f5b178d5db9"></a>Windows Registry

<a id="7e46b2cafccc94889e3ac2722bf6b321"></a>工具

<a id="bc2ad2bfa13e8f6877934465ea611bf8"></a>文章

2020.01 [4sysops] Audit changes in the Windows registry
2019.08 [hackerhurricane] The Windows Registry Auditing Cheat Sheet update! Aug 2019, v2.5
2019.03 [hecfblog] Daily Blog #640: Regipy - A new python windows registry forensics library
2019.01 [fireeye] Digging Up the Past: Windows Registry Forensics Revisited
2019.01 [sans] Plumbing the Depths - Windows Registry Internals
2018.03 [hackers] Digital Forensics, Part 5: Analyzing the Windows Registry for Evidence
2018.02 [ZeroNights] [Defensive Track]Maxim Suhanov - In depth forensic analysis of Windows registry files
2017.04 [redcanary] Windows Registry Attacks: Knowledge Is the Best Defense
2017.02 [alienvault] Are Windows Registry Fixers Safe?
2016.04 [windowsir] Windows Registry Forensics, 2E
2014.08 [trendmicro] POWELIKS: Malware Hides In Windows Registry
2013.09 [cylance] Windows Registry Persistence, Part 2: The Run Keys and Search-Order
2013.08 [cylance] Windows Registry Persistence, Part 1: Introduction, Attack Phases and Windows Services
2009.07 [windowsir] Windows Registry Forensic Analysis
2009.05 [moyix] Comprehensive New Resource on the Windows Registry
2008.02 [moyix] CredDump: Extract Credentials from Windows Registry Hives
2005.09 [windowsir] The Windows Registry as a Forensic Resource
2005.08 [sans] Updated Windows Registry Concealment Info;Symantec AV Vulnerability

<a id="9f0ddf6e87cbaabd865deebde52699d4"></a>Component Object Model(COM)

<a id="77b9b279c18b90c20f672b68cc946da1"></a>工具

<a id="798eea99c85b0c02ecbde54172e9e11b"></a>Distributed Component Object Model(DCOM)

<a id="424a04890b93f5642ee2f69e394c9be8"></a>工具

[225星][10d] [PS] outflanknl/excel4-dcom PowerShell and Cobalt Strike scripts for lateral movement using Excel 4.0 / XLM macros via DCOM (direct shellcode injection in Excel.exe)
[207星][1y] [PS] sud0woodo/dcomrade Powershell script for enumerating vulnerable DCOM Applications

<a id="b496048006faecf5545e9eb75072e718"></a>文章

2019.03 [freebuf] DCOMrade：一款枚举DCOM应用漏洞的PowerSHell脚本
2018.12 [n0where] Powershell Script for Enumerating Vulnerable DCOM Applications: DCOMrade
2018.12 [360] CVE-2015-2370之DCOM DCE/RPC协议原理详细分析
2018.12 [pediy] [原创]CVE-2015-2370之DCOM DCE/RPC协议原理详细分析
2018.07 [360] LethalHTA 一种结合DCOM和HTA的新型横向渗透技术
2018.07 [codewhitesec] LethalHTA - A new lateral movement technique using DCOM and HTA
2018.06 [4hou] 另一种滥用DCOM的内网渗透技术
2018.05 [360] 如何滥用DCOM实现横向渗透
2018.05 [pediy] [翻译] 利用“导出函数和DCOM接口”执行穿透指令、实现横向渗透
2018.04 [bohops] 利用DCOM实现远程Payload执行和横向渗透
2018.03 [DoktorCranium] VAX msrpc dcom ms03 026
2018.03 [360] 如何利用导出函数和暴露的DCOM接口来实现横向渗透
2018.03 [bohops] 利用DLL的导出函数和暴露的DCOM接口实现内网渗透
2018.01 [cybereason] New lateral movement techniques abuse DCOM technology
2017.11 [cybereason] 结合 Excel DDE 和 DCOM实现内网渗透
2017.10 [4hou] 域渗透——利用DCOM在远程系统执行程序
2017.09 [aliyun] 无视Office宏安全设置，利用EXCEL.APPLICATION和DCOM渗透内网
2017.09 [4hou] 无视Office宏安全设置，利用EXCEL.APPLICATION和DCOM渗透内网
2017.09 [3gstudent] 域渗透——利用DCOM在远程系统执行程序
2017.09 [3gstudent] 域渗透——利用DCOM在远程系统执行程序

<a id="9c0d0ea748ac8de5396932422c6cce10"></a>Dynamic Data Exchange(DDE)

<a id="5ff2332e36459054c8bf3ccd30480a1a"></a>文章

2017.11 [fortinet] Cybercriminals Exploiting Microsoft’s Vulnerable Dynamic Data Exchange Protocol
2017.10 [mcafee] Code Execution Technique Takes Advantage of Dynamic Data Exchange
2017.10 [mcafee] Code Execution Technique Takes Advantage of Dynamic Data Exchange
2017.10 [mcafee] Code Execution Technique Takes Advantage of Dynamic Data Exchange
2017.10 [homjxi0e] execute Commands And Coding in MSFT Word Via Exploiting application dynamic data exchange //DDE//

<a id="b05deb0cee0274fb02b27dd33edb80d1"></a>Compiled HTML Help(CHM)

<a id="a68ed31e2457d7ec9143428d05a8a755"></a>文章

2015.05 [checkpoint] The Microsoft Help File (.chm) May Enslave You | Check Point Software Blog
2015.03 [brashconcepts] New CryptoWall Attack: Block .CHM Extensions
2015.03 [freebuf] .Chm格式帮助文件作盾，CryptoWall勒索软件卷土重来
2009.06 [pediy] [原创]关于“IDA Pro 5.4 中文帮助手册.chm”在IDA打开文件时按F1出现错误的解决方法

<a id="cd351af78b7ca5139f3ae343ecb0dd9c"></a>WinSxS

<a id="1db8c6803d4c2abbdedc18aee7f85c8d"></a>工具

<a id="01210feb166b95c19ba9ac374f06a291"></a>WoW64

<a id="eb82daa5fe43dfd74bc02c47e2c4afe8"></a>工具

<a id="c6ca09f3f8597935d70aaf695629dc3a"></a>文章

2019.10 [hexacorn] IsWow64Process2
2019.07 [subTee] System32||Syswow64\Tasks\Tasks.dll
2019.04 [corelan] Windows 10 egghunter (wow64) and more
2019.04 [fsx30] Hooking Heaven’s Gate — a WOW64 hooking technique
2019.01 [sans] The WOW Effect - or how Microsoft's WOW64 technology unintentionally fools IT Security analysts
2018.11 [aliyun] Hook深度研究:监视WOW64程序在系统中的执行情况
2018.03 [sentinelone] 深度Hook: 监控Wow64程序的Native执行. Part 3
2018.03 [sentinelone] 深度Hook: 监控WOW64应用程序的Native执行 Part 2
2017.09 [pediy] [分享][原创]汇编里看Wow64的原理（浅谈32位程序是怎样在windows 64上运行的？）
2016.09 [sogeti] Deep-Dive in WoW64
2016.08 [x64dbg] 64bit Debugging and the WoW64 File System Redirection
2016.07 [corelan] Windows 10 x86/wow64 Userland heap
2015.12 [rewolf] wow64ext v1.0.0.8
2015.11 [modexp] DLL/PIC Injection on Windows from Wow64 process
2015.11 [tekwizz123] Some Observations On Duo Security's "WoW64 and So Can You" Paper
2015.11 [duo] WoW64 and So Can You
2015.08 [nul] 6.1.7600 (Win7 SP0) WinTrustVerify在关闭Wow64FsRedirection之后会出问题
2015.06 [rewolf] wow64ext v1.0.0.7
2015.06 [codereversing] Syscall Hooking Under WoW64: Implementation (2/2)
2015.06 [rewolf] WoW64 internals: Unexpected behaviour of NtQueryDirectoryObject

<a id="0f805859001b5b52d63a7172bd44cdf6"></a>Background Intelligent Transfer Service(BITS)

<a id="b2f8f87055fddd1cf1c2c11401ad4e04"></a>工具

<a id="a658066df321965f221208dd00abe422"></a>Batch Script(.bat)

<a id="b1c6b964c60022c9dcd4ff69072dbda5"></a>工具

[268星][9m] [Batchfile] diogo-fernan/ir-rescue A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
[216星][9d] [PS] enjoiz/privesc Windows batch script that finds misconfiguration issues which can lead to privilege escalation.

<a id="af21157c602c6800e744db567fd3e43c"></a>文章

2019.07 [markmotig] Write, Compile and Run a C# program in a single batch file
2018.07 [sans] Windows Batch File Deobfuscation
2018.07 [lallouslab] Batchography: Parsing INI files from a Batch file
2018.06 [ironcastle] Malicious Post-Exploitation Batch File, (Tue, Jun 5th)
2018.06 [sans] Malicious Post-Exploitation Batch File
2018.01 [HACKTRONIAN] Create Dangerous Viruses - Batch File (.bat) & Executable File (.exe)
2017.08 [fossmint] KRename – A Powerful Batch File Renamer for Linux
2016.01 [sentinelone] XRTN: More batch script-based Ransomware
2014.02 [dfstream] USB Device Tracking Batch Script
2012.03 [securityblog] Start or Stop Windows Service using batch file
2008.08 [securitythinkingcap] Pipe Dream: Data migration with batch files

<a id="bf6cc44eeb15bfccaf0bf3750be50e2b"></a>DACL

<a id="e7f9728a252a6e224e64a49da24b7312"></a>工具

[333星][11d] [PS] canix1/adaclscanner Repo for ADACLScan.ps1 - Your number one script for ACL's in Active Directory

<a id="04794a1f53e595fb81288e7f9a3ac1d4"></a>文章

2019.10 [HackersOnBoard] Black Hat USA 2017 An ACE Up the Sleeve Designing Active Directory DACL Backdoors
2019.04 [nsfocus] 【M01N】CVE-2019-0841 DACL权限覆盖本地提权漏洞攻击分析
2019.04 [aliyun] CVE-2019-0841：Windows DACL权限覆写权限提升漏洞
2017.08 [stealthbits] From Botnets to DACL Backdoors: A Journey through Modern Active Directory Attacks – Part I
2014.04 [secureidentity] ACL, DACL, SACL and the ACE
2013.11 [freebuf] 枚举和分析Windows DACLs工具 – WindowsDACLEnumProject

<a id="84f437e82aae8bfcecd2694e04fcf8aa"></a>WebDAV

<a id="eb4696a47c7673522fd42c2a6e7cd8a7"></a>工具

[465星][23d] [C++] winscp/winscp WinSCP is a popular free SFTP and FTP client for Windows, a powerful file manager that will improve your productivity. It supports also Amazon S3, FTPS, SCP and WebDAV protocols. Power users can automate WinSCP using .NET assembly.
[373星][2m] [Py] mar10/wsgidav A generic and extendable WebDAV server based on WSGI

<a id="869dec888564b2d2d13708bebbcc3f74"></a>文章

2019.06 [n00py] Understanding UNC paths, SMB, and WebDAV
2019.04 [hackingarticles] Command & Control: WebDav C2
2019.02 [sans] Scanning for WebDAV PROPFIND Exploiting CVE-2017-7269
2018.06 [trustedsec] How to Set Up a Quick, Simple WebDAV Server for Remote File Sharing
2017.09 [360] 利用WebDAV特性建立隐蔽后门
2017.09 [pentestlab] Command and Control – WebDAV
2017.09 [arno0x0x] Using WebDAV features as a covert channel
2017.03 [aliyun] IIS 6.0 WebDAV远程代码执行漏洞分析—【CVE-2017-7269】
2016.11 [blackhillsinfosec] Deploying a WebDAV Server
2016.08 [hackingarticles] Get Admin Access of Remote Windows PC using MS16-016 mrxdav.sys WebDav Escalation
2016.03 [freebuf] 微软“WebDAV”提权漏洞（cve-2016-0051）初探
2016.02 [avfisher] WebDAV本地提权漏洞（CVE-2016-0051/MS16-016）之交互式提权EXP
2016.02 [360] WebDAV本地提权漏洞（CVE-2016-0051）POC & EXP
2016.02 [freebuf] Windows最新“WebDAV”提权漏洞介绍（MS16-016）
2011.07 [firebitsbr] DAVTest: Teste rápido e exploits para WebDAV Servers
2010.07 [sans] LNK vulnerability now with Metasploit module implementing the WebDAV method
2009.05 [holisticinfosec] WebTuff checks for WebDAV vulnerability
2009.05 [sans] IIS admins, help finding WebDAV remotely using nmap
2009.05 [skullsecurity] WebDAV Detection, Vulnerability Checking and Exploitation
2009.05 [microsoft] Answers to the IIS WebDAV authentication bypass questions

<a id="9c71937ab7d82876aac2c54c150791cc"></a>Group Policy Object(GPO)

<a id="578d958b7bb54c88abdf496c6e30647b"></a>工具

[246星][16d] [C#] fsecurelabs/sharpgpoabuse take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.

<a id="c468de52ae51e1caca7a00483464dd72"></a>文章

2019.04 [stealthbits] How to Backup and Recover Group Policy Objects
2016.07 [stealthbits] Comprehensive Auditing and Protection For Group Policy Objects
2015.03 [darkoperator] Updating Group Policy Objects Remotely
2013.08 [jaapbrasser] Active Directory Friday: Query Group Policy Objects in Active Directory

<a id="6b68cefbacf54a6f75ca2f9018117a33"></a>AppInit/AppCert

<a id="296d6cf1fb87b343a3084344c76d59ac"></a>文章

2020.01 [pentestlab] Persistence – AppInit DLLs
2017.03 [toddcullumresearch] Inline Hook of a System Call via AppInit_DLLs Part 2– The Hook
2017.03 [toddcullumresearch] Inline Hook of a System Call via AppInit_DLLs Part 1 – Decryption of XOR Cipher
2016.05 [pediy] [原创]AppInit注入的那些事

<a id="8f547f4f2f1e71c746324e72861c43f1"></a>InstallUtil

<a id="b05e41c16bfafb2f11a5cab1d79b9460"></a>文章

2017.08 [tyranidslair] DG on Windows 10 S: Abusing InstallUtil

<a id="70f540d5729edd9eaf458082acdb22bc"></a>Image File Execution Option(IFEO)

<a id="16ffb3bcd11332055eb2adab920dff34"></a>文章

2020.01 [pentestlab] Persistence – Image File Execution Options Injection
2018.07 [360] 隐蔽后门——Image File Execution Options新玩法
2015.12 [malwarebytes] An Introduction to Image File Execution Options
2012.09 [] 通过IFEO劫持提权
2008.02 [sans] Abusing Image File Execution Options

<a id="3dc4542422de4f6e2a8ea5d4f36e2481"></a>Mshta

<a id="ec9ec7966300b8a41b394dd5cfbed4c7"></a>文章

2019.07 [mcafee] What Is Mshta, How Can It Be Used and How to Protect Against It
2019.07 [mcafee] What Is Mshta, How Can It Be Used and How to Protect Against It
2019.01 [hackingarticles] Bypass Application Whitelisting using mshta.exe (Multiple Methods)
2017.12 [freebuf] 浅谈一下mshta在CVE-2017-11882里的命令构造
2017.11 [conscioushacker] Application Whitelisting Bypass: mshta.exe
2016.06 [evi1cg] Exec Commands Via Mshta.exe

<a id="8722d46369d07d677ad27d467c45e174"></a>Microsoft HTML Application(HTA)

<a id="77e8c723a9f3e2b1df9b7778947c3400"></a>文章

2015.08 [redcanary] Microsoft HTML Application (HTA) Abuse, Part Deux

<a id="7d3e42507cd5aef335800a1ad2ef81f2"></a>NetShell

<a id="8be076273c1e4f30dc40065080573125"></a>工具

<a id="bb3384e6aeb99870a31bc93c01f6a76e"></a>文章

2016.09 [360] 使用Netshell执行恶意DLL并实现对目标主机的持久化攻击

<a id="4dad410f6466bbb44dd8f722a98b4542"></a>VBScript

<a id="cb35c6d81a6e143b6a70680e8ef9e02d"></a>工具

[1615星][12d] [Py] zerosum0x0/koadic 类似于Meterpreter、Powershell Empire 的post-exploitation rootkit，区别在于其大多数操作都是由 Windows 脚本主机 JScript/VBScript 执行

<a id="8d9d82756a32f13fcba26616b4f9aaf0"></a>文章

2019.12 [aliyun] 基于VBSCRIPT下16进制木马的IE浏览器BYPASS
2019.11 [trustedsec] Finding and Identifying JScript/VBScript Callable COM Objects
2019.10 [hexacorn] Rundll32 with a vbscript: protocol
2019.10 [Kaspersky] Exploit Prevention: VBScript Memory Corruption in IE
2019.04 [trendmicro] Analysis: Abuse of Custom Actions in Windows Installer MSI to Run Malicious JavaScript, VBScript, and PowerShell Scripts
2019.04 [4hou] VBScript引擎堆溢出远程代码执行漏洞分析（CVE-2019-0666）
2019.02 [360] VBScript in 2018
2019.01 [pediy] IE VBScript 漏洞之CVE-2018-8174
2019.01 [pediy] IE VBScript 漏洞之CVE-2014-6332
2018.12 [googleprojectzero] ProjectZero关于VBScript安全性的探讨
2018.12 [freebuf] Windows VBScript引擎远程执行代码漏洞之CVE-2018-8373分析与复现
2018.11 [360] Windows VBScript引擎远程执行代码漏洞之CVE-2018-8373分析与复现
2018.11 [4hou] Windows VBScript引擎远程执行代码漏洞之CVE-2018-8373分析与复现
2018.11 [360] VBScript引擎远程代码执行漏洞之CVE-2018-8174分析与利用（更新）
2018.11 [4hou] Windows VBScript引擎远程执行代码漏洞之CVE-2018-8174分析与利用
2018.11 [360] Windows VBScript引擎RCE漏洞之CVE-2018-8174分析与利用
2018.09 [paloaltonetworks] Traps Prevents In-The-Wild VBScript Zero-Day Exploit in Internet
2018.08 [aliyun] CVE-2018-8373：VBScript引擎UAF漏洞
2018.08 [trendmicro] Use-after-free (UAF) Vulnerability CVE-2018-8373 in VBScript Engine Affects Internet Explorer to Run Shellcode
2018.07 [360] Analysis of the new exploitable issues with CVE-2018-8174 patch and VBScript zero-day vulnerability

<a id="ded9537532637d9e8cf34103b8074bb9"></a>VBA

<a id="80b5cac54622fc99de46e2de95f2d187"></a>工具

[565星][2m] [Py] decalage2/vipermonkey A VBA parser and emulation engine to analyze malicious macros.
[262星][7m] [Py] bontchev/pcodedmp A VBA p-code disassembler
[226星][8m] [Py] malwarecantfly/vba2graph Generate call graphs from VBA code, for easier analysis of malicious documents.

<a id="24e894db7a4d419a9b186cd5546fdcd2"></a>文章

2019.10 [marcoramilli] Frequent VBA Macros used in Office Malware
2019.06 [freebuf] Matlab加上VBA编程，表格就能画画了
2019.06 [beny] Weaponization: Howto Fully Undetectable Empire Powershell MS macro (VBA obfuscation & Stomping)
2019.05 [malcomvetter] Choose Your Own Red Team Adventure: Processes from VBA Macro
2019.05 [sans] VBA Office Document: Which Version?
2019.04 [pcsxcetrasupport3] A look at Stomped VBA code and the P-Code in a Word Document
2019.02 [lucasg] Discovering Nvidia NvBackend endpoint
2019.01 [pcsxcetrasupport3] A deeper look into a wild VBA Macro
2018.12 [freebuf] Vba2Graph：一款通过VBA代码分析恶意软件的强大工具（带GUI）
2018.12 [DoktorCranium] NetBSD evbarm Pinebook video test
2018.11 [ironcastle] ViperMonkey: VBA maldoc deobfuscation, (Mon, Nov 26th)
2018.11 [sans] ViperMonkey: VBA maldoc deobfuscation
2018.11 [vkremez] Let's Learn: In-Depth Review of FIN7 VBA Macro & Lightweight JavaScript Backdoor
2018.11 [hexacorn] 使用VBA/VBS分析Word文档
2018.10 [aliyun] 攻击者是如何隐藏恶意VBA 代码行为的
2018.08 [ColinHardy] Analysing Obfuscated VBA - Extracting indicators from a Trickbot downloader
2018.05 [scrt] Insomni’hack 2018 – vba03-strikeBack writeup
2018.04 [dist67] VBA Maldoc: Form-Embedded PE File
2018.04 [virusbulletin] New paper: Powering the distribution of Tesla stealer with PowerShell and VBA macros
2018.04 [pentestingexperts] ViperMonkey v0.06 released: A VBA parser and emulation engine to analyze malicious macros

<a id="fdaecf463cde0ace2baf674360118a19"></a>Security Service Provider(SSP)

<a id="ca71d3c8c759ef191253380e005213c0"></a>文章

2018.05 [ensilo] Customers Say It Best - Managed Security Service Provider
2018.05 [infosecinstitute] What is the DoD CSSP (Cyber Security Service Provider)?
2018.03 [nettitude] Building a secure future – Cyber security service provider Nettitude joins the Lloyd’s Register group
2017.09 [trustlook] Trustlook Selected as 10 Best Security Service Providers of 2017
2017.09 [trustlook] Trustlook Selected as 10 Best Security Service Providers of 2017
2017.05 [fortinet] Trends Affecting Managed Security Service Providers
2017.03 [fortinet] Managed Security Service Providers, Choosing the Right Security Vendor
2016.07 [fortinet] Security Trends: Managed Security Service Providers

<a id="cbe7925b4695d3f5e9f72f432a6530dc"></a>Scheduled Task

<a id="f52a95e272df2e86c388e0dd076c4c6f"></a>工具

[432星][1m] [Py] sibson/redbeat RedBeat is a Celery Beat Scheduler that stores the scheduled tasks and runtime metadata in Redis.
[385星][1m] [C#] dahall/taskscheduler Provides a .NET wrapper for the Windows Task Scheduler. It aggregates the multiple versions, provides an editor and allows for localization.

<a id="85a4495e6c53b1f5de50d3cf42de1084"></a>文章

2019.11 [aliyun] 持久化研究-Scheduled Tasks
2019.09 [markmotig] Command prompt with System rights using Schtasks, Ncat and Metame
2019.06 [zerodayinitiative] Exploiting the Windows Task Scheduler Through CVE-2019-1069
2018.05 [ironcastle] Adding Persistence Via Scheduled Tasks, (Mon, May 7th)
2018.05 [sans] Adding Persistence Via Scheduled Tasks
2016.05 [enigma0x3] Userland Persistence with Scheduled Tasks and COM Handler Hijacking
2015.04 [jaapbrasser] New article on PowerShell Magazine: Retrieve scheduled tasks using Schedule.Service COMObject
2015.03 [malwarebytes] Scheduled Tasks
2013.02 [mikefrobbins] Use PowerShell to Create a Scheduled Task that Uses PowerShell to Pause and Resume AppAssure Core Replication

<a id="0f90a8ce54f7bff9128b404dbab3d314"></a>Windows Remote Management(WinRM)

<a id="a0fe36873097f6dff84cdd7b3fe52fb2"></a>工具

[708星][13d] [Ruby] hackplayers/evil-winrm 用户Hacking/渗透的终极WinRM shell
[238星][10d] [Go] masterzen/winrm Windows远程命令执行，命令行工具+库，Go编写

<a id="c754ad3133666a921f924a0366fda9e0"></a>文章

2019.11 [hakin9] Evil-WinRM: The ultimate WinRM shell for hacking/pentesting
2019.08 [freebuf] evil-winrm：Windows远程管理（WinRM）Shell终极版
2018.07 [freebuf] 利用Winrm.vbs绕过白名单限制执行任意代码
2018.07 [4hou] 如何使用winrm.vbs绕过应用白名单执行任意未签名代码
2018.07 [360] 使用 winrm.vbs 绕过应用白名单执行任意未签名代码
2018.07 [aliyun] 利用winrm.vbs绕过应用程序白名单执行任意未签名代码
2018.07 [mattifestation] Application Whitelisting Bypass and Arbitrary Unsigned Code Execution Technique in winrm.vbs
2018.06 [specterops] Application Whitelisting Bypass and Arbitrary Unsigned Code Execution Technique in winrm.vbs
2018.05 [pentestlab] 利用Windows远程管理服务实现横向渗透
2017.09 [trustedsec] Using WinRM Through Meterpreter
2015.03 [darkoperator] WinRM SSL Certificate Deployment via GPO
2014.12 [rsa] Detecting APT Using Anomalous Windows Remote Management Methods and Dynamic RPC Endpoint Mapping
2014.07 [jaapbrasser] Setting up PowerShell Remoting using winrm quickconfig or Enable-PSRemoting fails
2013.03 [rapid7] Whiteboard Wednesday - Abusing Windows Remote Management with Metasploit
2012.11 [rapid7] Abusing Windows Remote Management (WinRM) with Metasploit
2012.10 [netspi] Exploiting Trusted Hosts in WinRM

<a id="567c09f34e35410dc959657beb4da4d3"></a>Control Panel

<a id="2f0c44bd470537ea2924f941129ec965"></a>工具

<a id="62bd550f94a11d68207c58a1753479cc"></a>文章

2019.01 [cofense] Phishing Campaigns are Manipulating the Windows Control Panel Extension to Deliver Banking Trojans
2016.12 [8090] win10控制面板在哪_Win10控制面板打不开怎么解决
2016.08 [mcafee] ‘Cat-Loving’ Mobile Ransomware Operates With Control Panel
2016.08 [mcafee] ‘Cat-Loving’ Mobile Ransomware Operates With Control Panel
2015.06 [jaapbrasser] Open Master Control Panel using PowerShell
2014.03 [trendmicro] Anatomy of a Control Panel Malware Attack, Part 2
2014.03 [trendmicro] Anatomy of a Control Panel Malware Attack, Part 1
2013.12 [] LNMP ftp控制面板安装程式未删除的漏洞
2013.06 [securityblog] Enable or Disable Control Panel
2013.06 [sans] Control Panel Forensics: Evidence of Time Manipulation and Moreâ¦
2012.03 [leehong2005] Control Panel Applet 实现
2011.10 [mikedoszhang] Remove useless item form the Control Panel\All Control Panel Items

<a id="6bdc12478a16b13a33c7ecd353f967b1"></a>Windows Shortcut File

<a id="4a28a030e4074a0d09d31f9cadf7378f"></a>工具

<a id="29bf70714f8426a6f7804e277cb7b378"></a>文章

2017.07 [sans] Another .lnk File
2017.07 [sans] Office maldoc + .lnk
2017.04 [nviso] 如何从Word文档中提取.LNK文件，以及如何分析
2017.03 [sentinelone] Understanding The State of .LNK Files
2017.03 [nviso] 恶意文档内嵌的.LNK下载者分析
2017.02 [myonlinesecurity] various subject emails downloading .lnk files using PowerShell to download various malwares
2016.10 [willgenovese] tricky.lnk – Unicode Text Spoofing
2016.10 [microsoft] The new .LNK between spam and Locky infection
2016.10 [microsoft] The new .LNK between spam and Locky infection
2016.06 [onready] Hijacking Windows hotkeys with .lnk file or Old horse raids
2016.06 [onready] Embedding reverse shell in .lnk file or Old horse attacks
2016.02 [sans] Analyzis of a Malicious .lnk File with an Embedded Payload
2016.02 [onready] DOCX on fire: .lnk in docx
2010.07 [sans] autorun.inf and .lnk Malware (NOT 'Vulnerability in Windows Shell Could Allow Remote Code Execution' 2286198)
2010.07 [sans] Update on .LNK vulnerability
2010.04 [pediy] [原创]windows平台.lnk文件感染技术研究

<a id="09220acd8a80f802a330028acfd6454d"></a>Windows Explorer

<a id="70a08a1d4ae425b9c2e2e336b832754a"></a>工具

<a id="97b6c206893c0d72beebd5c122542933"></a>文章

2018.08 [insert] Leaking Environment Variables in Windows Explorer via .URL or desktop.ini files
2013.06 [securityblog] Refresh all opened Windows Explorer windows
2010.08 [rebootuser] Mount a VMware vmdk (virtual disk) in Windows Explorer
2006.08 [sans] MS06-045: Windows Explorer Remote Code Excution Vulnerability

<a id="4305fed600ce259233802ea6c6626887"></a>Application Shim

<a id="10b9816b4775f22260658eef1d41860a"></a>文章

2020.01 [hackingarticles] Windows Persistence using Application Shimming
2019.06 [hshrzd] Application shimming vs Import Table recovery
2018.11 [andreafortuna] Process Injection and Persistence using Application Shimming
2018.03 [countercept] Hunting for Application Shim Databases
2018.03 [countercept] Hunting for Application Shim Databases
2018.02 [redcanary] Detecting Application Shimming: A Story About Continuous Improvement
2016.08 [blacksunhackers] Post Exploitation Persistence With Application Shims (Intro)

<a id="061272d088606ae0778a04b31f3c0e46"></a>Squiblydoo

<a id="1bd9e5df8902faae521e1dff195f2dbc"></a>文章

2019.03 [myonlinesecurity] Trickbot via fake Efax message using Squiblydoo, Active X, macro and abusing pastebin
2016.04 [rsa] Detection of Squiblydoo COM+ Whitelist Bypassing with ECAT

<a id="29ae3a9557d3c14f79aad2303e6bb828"></a>Open Office XML

<a id="177dd1d296e82b2dfad2cdcb2a37be2d"></a>工具

<a id="1c2073da678b183d1872ee62c568e7f5"></a>其他

<a id="928770b6fa4ff230a685448ae6573e52"></a>各类软件

<a id="9bb54db4c51a3d146863d4ce1d36c498"></a>MS Internet Explorer

<a id="d1119ba6c8e896a186d925ccac371d59"></a>工具

<a id="9003b6891f28795af6a0f11622ed813b"></a>MS Edge

<a id="ea3a3225108e179d9afe0b6e017dde52"></a>工具

[8097星][2m] [JS] microsoft/chakracore ChakraCore is the core part of the Chakra JavaScript engine that powers Microsoft Edge
[2356星][1y] microsoftedge/msedge Microsoft Edge
[217星][4m] [Go] improbable-eng/kedge kEdge - Kubernetes Edge Proxy for gRPC and HTTP Microservices

<a id="0019e616c7579c7151faf531b4a0c771"></a>文章

2020.02 [4sysops] Deploy and manage Microsoft Edge using WSUS and GPOs
2019.09 [4hou] Microsoft Edge浏览器的Universal XSS漏洞分析（CVE-2019-1030）
2019.09 [aliyun] Microsoft Edge - Universal XSS
2019.08 [microsoft] Announcing the Microsoft Edge Insider Bounty
2019.07 [4sysops] Hands-on review of Microsoft Edge (Chromium) business features: GPO support, IE mode, offline installer
2019.06 [payatu] Microsoft Edge Extensions Host Permission Bypass (CVE-2019-0678)
2019.06 [payatu] microsoft edge extensions host-permission bypass (cve-2019-0678)
2019.05 [exodusintel] Pwn2Own 2019: Microsoft Edge Sandbox Escape (CVE-2019-0938). Part 2
2019.05 [exodusintel] Pwn2Own 2019: Microsoft Edge Renderer Exploitation (CVE-2019-0940). Part 1
2019.05 [freebuf] Microsoft Edge和IE浏览器同源策略绕过漏洞分析
2019.04 [] Microsoft Edge Uses a Secret Trick And Breaks Internet Explorer's Security
2019.04 [topsec] 天融信关于Microsoft Edge和IE浏览器同源策略绕过漏洞分析
2019.04 [venus] 关于 Microsoft Edge 和 IE 浏览器同源策略绕过漏洞分析
2019.04 [trendmicro] Microsoft Edge and Internet Explorer Zero-Days Allow Access to Confidential Session Data
2019.03 [aliyun] 深入分析Microsoft Edge Chakra JIT类型混淆漏洞的利用方式
2019.03 [360] Microsoft Edge CVE-2019-0539 漏洞分析与利用
2019.02 [4hou] Microsoft Edge Chakra JIT类型混淆漏洞分析（CVE-2019-0539）
2019.02 [trendmicro] Announcing Trend Micro Security for Microsoft Edge
2018.12 [4hou] 在Microsoft Edge中实现DOM树
2018.10 [fortinet] An Analysis of Microsoft Edge Chakra JavascriptArray TypeId Handling Memory Corruption (CVE-2018-8467)

<a id="63479a46662292ab817171322fecfcf4"></a>MS Office

<a id="40ce3b16876770b8c0bf0e67c0abf1e8"></a>工具

[1731星][1m] [JS] ziv-barber/officegen Standalone Office Open XML files (Microsoft Office 2007 and later) generator for Word (docx), PowerPoint (pptx) and Excell (xlsx) in javascript. The output is a stream.
[1066星][20d] [Rich Text Format] decalage2/oletools python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
[750星][9d] [C#] outflanknl/evilclippy A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.
[407星][2m] [YARA] guelfoweb/peframe PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.

<a id="0e7bba8c1c7a86374dad4962cb4bfd9f"></a>文章

2020.02 [talosintelligence] Microsoft Office Excel Ordinal43 code execution vulnerability
2019.11 [talosintelligence] Microsoft Office Excel WorksheetOptions Code Execution Vulnerability
2019.10 [Kaspersky] Exploit Prevention: Microsoft Office Memory Corruption
2019.09 [zerodayinitiative] CVE-2019-0801: Microsoft Office Uri Hyperlink Hijinks
2019.08 [freebuf] CVE-2018-0798：Microsoft office 公式编辑器 Matrix record 栈溢出漏洞分析
2019.08 [trendmicro] Asruex Backdoor Variant Infects Word Documents and PDFs Through Old MS Office and Adobe Vulnerabilities
2019.06 [NullByte] Crack Password-Protected Microsoft Office Files [Tutorial]
2019.05 [nviso] Detecting and Analyzing Microsoft Office Online Video
2019.05 [mdsec] Persistence: “the continued or prolonged existence of something”: Part 1 – Microsoft Office
2019.05 [freebuf] 揭秘如何使用跨平台的EvilClippy创建恶意MS Office文档
2019.04 [kaspersky] Microsoft Office and its vulnerabilities
2019.04 [TROOPERScon] TR19: MS Office file format sorcery
2019.02 [myonlinesecurity] Formbook via fake invoice using Microsoft Office Equation Editor exploits
2019.01 [myonlinesecurity] Azorult via fake inquiry email using Microsoft Office Equation Editor exploits
2019.01 [fuzzysecurity] Microsoft Office 2003 Home/Pro 0day
2018.12 [proofpoint] LCG工具包: 复杂的恶意Microsoft Office文档构建器
2018.10 [checkpoint] Microsoft Office Vulnerability Found, Check Point Research To The Rescue | Check Point Software Blog
2018.10 [4hou] 通过Microsoft Office和YouTube视频传递恶意软件的PoC攻击
2018.10 [stationx] Malware payloads latest: Microsoft Office macros remain the most frequently used delivery method
2018.09 [sans] Dissecting Malicious MS Office Docs

<a id="979c4f76c79c7e7a453727c7d6ecd539"></a>EMET

<a id="9d5a8c1da43df3879057ee7f1cd48c4e"></a>工具

<a id="c968b8e10a7f96dfdbea90a85e86c02c"></a>文章

2019.10 [HackersOnBoard] Black Hat USA 2016 Using EMET to Disable EMET
2018.08 [cmu] Life Beyond Microsoft EMET
2018.03 [4hou] Windows 10 RS3中的EMET ASR功能优劣分析
2018.01 [mattifestation] The EMET Attack Surface Reduction Replacement in Windows 10 RS3: The Good, the Bad, and the Ugly
2018.01 [mattifestation] The EMET Attack Surface Reduction Replacement in Windows 10 RS3: The Good, the Bad, and the Ugly
2017.08 [rootedconmadrid] PABLO SAN EMETERIO - Inteligencia privada, más allá de STIX [Rooted CON 2017 - ENG]
2017.08 [rootedconmadrid] PABLO SAN EMETERIO - Inteligencia privada, más allá de STIX [Rooted CON 2017 - ESP]
2017.04 [ropchain] 一个写操作，解除EMET 5.52的武装！
2017.03 [grandstreamdreams] Enhanced Mitigation Experience Toolkit (EMET) 5.5/5.52 Uninstall Error 2738
2017.03 [pediy] [翻译]野外的 CVE-2015-2545 逃逸了 EMET
2017.03 [pediy] [翻译]EPS文件利用如何逃逸 EMET(CVE-2015-2545) —— 一次技术探索
2017.01 [microsoft] EMET 5.52 update is now available
2016.11 [sophos] Moving beyond EMET, Part 2
2016.11 [dist67] EMET vs Hancitor Maldoc
2016.11 [dist67] VBA Shellcode To Test EMET
2016.11 [cmu] Windows 10 Cannot Protect Insecure Applications Like EMET Can
2016.11 [morphisec] EMET Refuses to Die
2016.11 [sans] VBA Shellcode and EMET
2016.11 [microsoft] Bringing EMET protections into Windows 10
2016.11 [microsoft] Moving Beyond EMET

<a id="98f74e5f893a0c326ef336619bc515c4"></a>psexec

<a id="336e94749dba45c45e97e436673d38a0"></a>工具

[264星][14d] [C++] poweradminllc/paexec Remote execution, like PsExec

<a id="0d2c5f807488fe1e68d9a968d04d2b56"></a>文章

2019.10 [freebuf] GlobeImposter2.0再出新变种，疑似利用PsExec内网传播
2019.09 [4hou] GlobeImposter2.0再出新变种，疑似利用PsExec内网传播
2019.04 [trendmicro] Account With Admin Privileges Abused to Install BitPaymer Ransomware via PsExec
2018.11 [redcanary] Threat Hunting for PsExec, Open-Source Clones, and Other Lateral Movement Tools
2018.11 [countercept] Endpoint Detection of Remote Service Creation and PsExec
2018.11 [countercept] Endpoint Detection of Remote Service Creation and PsExec
2018.11 [cybertriage] 使用PsExec登陆远程系统可能导致密码泄漏
2018.09 [contextis] Lateral movement: A deep look into PsExec
2018.09 [contextis] Lateral movement: A deep look into PsExec
2018.04 [hexacorn] A quick note about PSExecutionPolicyPreference
2018.01 [venus] 老牌工具 PsExec 一个琐碎的细节
2017.12 [hexacorn] PsExec going places…
2017.12 [pediy] [原创]PsExec 在当前会话下启动系统权限进程原理
2017.06 [guyrleech] Petya：禁止 psexec 远程执行
2017.06 [guyrleech] Petya: easily disabling access to psexec
2017.06 [rastamouse] PsExec Much?
2017.05 [govolution] Write your own metasploit psexec service
2017.05 [moxia] 【技术分享】丢掉PSEXEC来横向渗透
2017.03 [rapid7] Combining Responder and PsExec for Internal Penetration Tests
2017.03 [mindpointgroup] Lateral Movement with PSExec

<a id="4a17ea9f0555ae7c61b9762fd789b23c"></a>Nltest

<a id="5c1479af60b597303b2a885e92c1e384"></a>CMSTP.exe

<a id="cc6df9989a20eb5dd533f032daeca9b3"></a>Rundll32

<a id="1e1be483a674d3e6330b31f0f11dadb5"></a>工具

<a id="68b21ccc26f1f7877ae8e70a907e67ce"></a>文章

2020.01 [reegun] Curl.exe is the new rundll32.exe — LOLbin
2019.09 [hexacorn] RunDll32 — API calling
2019.01 [hackingarticles] Bypass Application Whitelisting using rundll32.exe (Multiple Methods)
2018.11 [hexacorn] advpack.dll ! DelNodeRunDLL32 and its flags
2018.11 [aliyun] 如何利用RunDLL32调用.NET Assembly
2018.11 [xpnsec] 使.NET程序集导出静态函数, 并使用RunDLL32加载
2018.03 [3gstudent] 关于利用rundll32执行程序的分析
2018.03 [3gstudent] 关于利用rundll32执行程序的分析
2018.03 [aliyun] 关于利用rundll32执行程序的分析
2018.01 [freebuf] 命令行下的“蒙面歌王”rundll32.exe
2016.07 [cobaltstrike] Why is rundll32.exe connecting to the internet?
2014.02 [attackdebris] rundll32 lockdown testing goodness

<a id="3ebe3d66a05d92aed5459ed72f1e3678"></a>Regsvr32

<a id="c739394b21b3aad9293b747d7d141956"></a>工具

<a id="fdd93367db93bf20c10b5dbb6f6e1b0f"></a>文章

2017.11 [conscioushacker] Application Whitelisting Bypass: regsvr32.exe
2017.05 [blackhillsinfosec] How to Evade Application Whitelisting Using REGSVR32
2016.07 [hackingarticles] Hack Remote Windows PC using Regsvr32.exe (.sct) Application Whitelisting Bypass Server
2013.09 [dustri] regsvr32 returns 0x80070005

<a id="70d731a999b1cd69d565e35c98540ec9"></a>Regasm

<a id="b2008a3c57c0e58f8ea1d03f583eb1c1"></a>Regsvcs

<a id="c8596ed2e3d35337492ccffcd5a87027"></a>svchost

<a id="1928a187378080b11b7119305b61aad5"></a>工具

<a id="45a0356bc132fc320e96e8bbb5b340f9"></a>文章

2017.12 [hexacorn] svchost.exe -> explorer.exe on win10
2015.12 [hexacorn] The typographical and homomorphic abuse of svchost.exe, and other popular file names
2013.12 [myonlinesecurity] XP SP3 Svchost causes high (100%) CPU usage when updating
2013.11 [myonlinesecurity] Windows XP update locks machines with SVCHOST redlined at 100%: Fix it with KB 2879017 | Microsoft windows – InfoWorld
2013.07 [hexacorn] The typographical and homomorphic abuse of svchost.exe
2011.01 [pediy] [原创]svchost进程的浅析

<a id="666aceb7939a7ba06d77a71a2baffeee"></a>MSBuild

<a id="0f3c4b5cdc69b98c87e175ef7bb76396"></a>工具

[4136星][7d] [C#] microsoft/msbuild The Microsoft Build Engine (MSBuild) is the build platform for .NET and Visual Studio.
[728星][9m] [Py] mr-un1k0d3r/powerlessshell 依靠MSBuild.exe远程执行PowerShell脚本和命令
[226星][7m] [Py] infosecn1nja/maliciousmacromsbuild Generates Malicious Macro and Execute Powershell or Shellcode via MSBuild Application Whitelisting Bypass.

<a id="1e5138d2ba592b1886ed23b8d22d2e07"></a>文章

2019.06 [rastamouse] TikiSpawn & MSBuild
2019.01 [hackingarticles] Bypass Application Whitelisting using msbuild.exe (Multiple Methods)
2017.11 [freebuf] 海莲花团伙利用MSBuild机制免杀样本分析
2017.11 [360] 海莲花团伙利用MSBuild机制免杀样本分析
2017.11 [venus] 海莲花团伙利用MSBuild机制免杀样本分析
2017.11 [conscioushacker] Application Whitelisting Bypass: msbuild.exe
2017.01 [codepool] Using MSBuild for DLL configuration files, transformations and output to referencing projects.
2016.10 [] Use MSBuild To Do More（渗透中MSBuild的应用技巧）
2016.09 [360] Use MSBuild To Do More（渗透中MSBuild的应用技巧）
2016.09 [3gstudent] Use MSBuild To Do More
2016.09 [sysprogs] 10 Reasons to Try Out MSBuild for your VisualGDB Projects
2013.09 [redplait] msbuild 4.0 debugger
2013.09 [redplait] clang and msbuild integration
2013.01 [lowleveldesign] MSBuild: MSB3275 warning, GAC and .NET version

<a id="6f70488efd1c03c94c309fb6e1e7f28a"></a>csrss.exe

<a id="9abd04f5352aa1714ccef5012cc33c6c"></a>文章

2018.03 [pediy] [原创]驱动注入用户线程之跨session通知csrss之真正解决
2015.08 [pediy] [原创]纯C++编写Win32/X64通用Shellcode注入csrss进程.
2012.05 [pediy] [原创]Csrss进程剖析
2011.08 [vexillium] 0-day Windows XP SP3 Denial of Service (CSRSS Crash #1)
2011.08 [vexillium] 0-day Windows XP SP3 Denial of Service (CSRSS Crash)
2011.07 [vexillium] CVE-2011-1281: A story of a Windows CSRSS Privilege Escalation vulnerability
2011.07 [vexillium] CVE-2011-1281: A story of a Windows CSRSS Privilege Escalation vulnerability
2010.07 [vexillium] Windows CSRSS Write Up: Inter-process Communication (part 2/3)
2010.07 [vexillium] Windows CSRSS Write Up: Inter-process Communication (part 2/3)
2010.07 [vexillium] Windows CSRSS Write Up: Inter-process Communication (part 1/3)
2010.07 [vexillium] Windows CSRSS Write Up: Inter-process Communication (part 1/3)
2010.07 [vexillium] Windows CSRSS Write Up: the basics (part 1/1)
2010.07 [vexillium] Windows CSRSS write up: the basics
2010.05 [pediy] [原创]详解进程创建中与csrss的通信流程
2010.05 [coldwind] Windows CSRSS cross-version API Table
2010.05 [vexillium] Windows CSRSS cross-version API Table
2010.05 [vexillium] Windows CSRSS cross-version API Table
2010.02 [coldwind] Microsoft Windows CSRSS Local Privilege Elevation Vulnerability
2009.05 [pediy] [原创]CsrssWalker学习笔记(附源代码)
2009.03 [pediy] [原创]CsrssVuln.exe源代码及分析

<a id="65a0235ddaea9da80145fa441eb0af2a"></a>其他exe

<a id="eceb5b79694c803399b0de795fffc296"></a>文章

2019.05 [hexacorn] msiexec.exe as a LOLBIN
2019.04 [talosintelligence] Shimo VPN helper tool RunVpncScript privilege escalation vulnerability
2019.01 [hackingarticles] Bypass Application Whitelisting using msiexec.exe (Multiple Methods)
2018.09 [redcanary] Detecting MSXSL Abuse in the Wild
2018.07 [4hou] mavinject.exe的新用法
2018.05 [mattifestation] mavinject.exe Functionality Deconstructed
2018.05 [mattifestation] mavinject.exe Functionality Deconstructed
2018.04 [hexacorn] Curious case of the conhost.exe and condrv.sys
2018.03 [reaqta] Spear-phishing campaign leveraging on MSXSL
2018.02 [4hou] LokiBot变种正在使用msiexec.exe安装后门
2018.02 [360] 借助Windows Installer的msiexec.exe实现LokiBot恶意软件感染
2018.02 [trendmicro] Attack Using Windows Installer msiexec.exe leads to LokiBot
2017.12 [reaqta] From False Positive to True Positive: the story of Mavinject.exe, the Microsoft Injector
2017.01 [4hou] 渗透测试中的msiexec
2016.12 [3gstudent] 渗透测试中的msiexec
2016.12 [3gstudent] 渗透测试中的msiexec
2016.12 [4hou] PowerShell技巧——借助kd.exe隐藏进程
2016.12 [nettitude] Fun with Windows binaries – application whitelist bypass using msiexec
2016.12 [3gstudent] Powershell tricks::Hide Process by kd.exe
2016.11 [3gstudent] Study Notes of using dnx.exe / rcsi.exe to bypass Decvice Guard UMCI

<a id="d7a63740447f820c26b938b5bc391ef3"></a>SysInternalSuite

<a id="0fed6a96b28f339611e7b111b8f42c23"></a>Sysmon

<a id="d48f038b58dc921660be221b4e302f70"></a>工具

[2177星][1m] swiftonsecurity/sysmon-config Sysmon configuration file template with default high-quality event tracing
[715星][23d] [PS] olafhartong/sysmon-modular sysmon配置模块收集
[667星][2m] nshalabi/sysmontools Utilities for Sysmon
[546星][12d] mhaggis/sysmon-dfir Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
[455星][1y] [Batchfile] ion-storm/sysmon-config Advanced Sysmon configuration, Installer & Auto Updater with high-quality event tracing
[246星][13d] [CSS] trustedsec/sysmoncommunityguide TrustedSec Sysinternals Sysmon Community Guide

<a id="2c8cb7fdf765b9d930569f7c64042d62"></a>文章

2020.01 [bugbountywriteup] Unloading the Sysmon Minifilter Driver
2019.12 [] How to Test Bro-Sysmon
2019.12 [vanimpe] Use Sysmon DNS data for incident response
2019.11 [4hou] 你不知道的威胁狩猎技巧：Windows API 与 Sysmon 事件的映射
2019.10 [HackersOnBoard] Subverting Sysmon Application of a Formalized Security Product Evasion Methodology
2019.09 [sans] Parsing Sysmon Events for IR Indicators
2019.09 [blackhillsinfosec] Getting Started With Sysmon
2019.09 [osandamalith] Unloading the Sysmon Minifilter Driver
2019.09 [matterpreter] Shhmon — Silencing Sysmon via Driver Unload
2019.09 [specterops] Shhmon — Silencing Sysmon via Driver Unload
2019.09 [4hou] 如何逃逸Sysmon工具对DNS的监控
2019.09 [olafhartong] Sysmon 10.4 release
2019.09 [blackhillsinfosec] Webcast: Windows logging, Sysmon, and ELK
2019.08 [blackhillsinfosec] Webcast: Implementing Sysmon and Applocker
2019.07 [eforensicsmag] Using Sysmon and ETW For So Much More | By David Kennedy
2019.06 [nosecurecode] Sysmon in a Box
2019.06 [binarydefense] Using Sysmon and ETW For So Much More - Binary Defense
2019.06 [360] 如何规避Sysmon DNS监控
2019.06 [SecurityWeekly] Sysmon DNS Logging, Gravwell - PSW #608
2019.06 [xpnsec] Evading Sysmon DNS Monitoring

<a id="dbc42caf465566897ecbb644fed1f271"></a>Procmon

<a id="518d80dfb8e9dda028d18ace1d3f3981"></a>工具

<a id="af06263e9a92f6036dc5d4c4b28b9d8c"></a>文章

2019.03 [eforensicsmag] DYNAMIC MALWARE ANALYSIS – PROCESS MONITOR AND EXPLORER | By Prasanna B Mundas
2018.10 [hexacorn] Process monitoring/Process cmd line monitoring – data sources
2018.10 [guyrleech] Dynamically Creating Process Monitor Filters
2018.02 [appsecconsulting] PCI Time-Based Requirements as a Starting Point for Business-As-Usual Process Monitoring
2017.07 [arxiv] [1707.03821] Process Monitoring on Sequences of System Call Count Vectors
2017.06 [lowleveldesign] How to decode managed stack frames in procmon traces
2017.02 [lowleveldesign] When procmon trace is not enough
2017.02 [guyrleech] When even Process Monitor isn’t enough
2016.09 [dist67] Malware: Process Explorer & Procmon
2015.06 [guyrleech] Advanced Procmon Part 2 – Filtering inclusions
2015.02 [vimeo] Innuendo keylogger process monitor
2014.12 [guyrleech] Advanced Procmon Part 1 – Filtering exclusions
2014.07 [toolswatch] [New Tool] El Jefe v2.1 – Windows Process Monitoring Released
2012.04 [toolswatch] Process Monitor v3.0 Released
2011.08 [zeltser] Process Monitor Filters for Malware Analysis and Forensics
2011.04 [toolswatch] (Windows SysInternals) Process Monitor v2.95 released
2011.01 [toolswatch] (Windows SysInternals) Process Monitor v2.94 released
2010.09 [pediy] [翻译]Process Monitor中文手册

<a id="7da65659e7e463379d32be654003662c"></a>Autoruns

<a id="c206afa40ed90711b49a572feb1e0c5b"></a>工具

<a id="23c49d681177101f0f7d15fcd15f2124"></a>文章

2019.05 [jdferrell3] Scheduled Task command with space “hides” the file from Autoruns
2019.04 [sans] Offline Autoruns Revisited - Auditing Malware Persistence
2019.04 [jdferrell3] Autoruns fails to resolve file path for a scheduled task with a space in the file path
2018.12 [hexacorn] I fought the Autoruns, and Autoruns won…
2018.07 [KyleHanslovan] RE: Evading Autoruns PoCs on Windows 10
2018.07 [sans] Using AutorunsToWinEventLog
2018.04 [oddvar] 利用Image File Execution Options中的GlobalFlags实现驻留, 绕过Autoruns.exe检测
2018.03 [oddvar] 利用RunOnceEx实现驻留, 能够躲避Autoruns.exe监测
2018.01 [p0w3rsh3ll] AutoRuns module compatible with PowerShell Core 6.0
2017.11 [360] 那些“躲避”微软autoruns工具的方法
2017.10 [conscioushacker] Evading Microsoft’s AutoRuns
2016.09 [defensivedepth] Integrating Autoruns with Security Onion
2015.07 [sans] Autoruns and VirusTotal
2012.11 [sketchymoose] Autoruns
2010.06 [sans] Autoruns and Dead Computer Forensics

<a id="fdae9f5a384a5c230e577ac972be2de4"></a>ProcessExplorer

<a id="1b24c5ac9ca199d0397380f902868c73"></a>文章

2018.09 [notsoshant] A small introduction to Process Explorer
2017.12 [hasherezade] Experiment: ProcessExplorer vs my "lil_calc"
2016.05 [malwarebytes] Process Explorer: part two
2016.05 [malwarebytes] Process Explorer: an introduction
2015.07 [sans] Process Explorer and VirusTotal
2014.01 [virusbulletin] VirusTotal support integrated into new version of Process Explorer
2014.01 [malwarebytes] Process Explorer Now Including VirusTotal Support
2013.12 [dist67] Using Process Explorer's Find Window's Process
2013.01 [securityblog] Process Explorer
2012.06 [toolswatch] Process Explorer v15.2 Released
2011.12 [toolswatch] Process Explorer v15.1 Released
2011.05 [toolswatch] (Windows SysInternals) Process Explorer v14.11 released
2011.03 [toolswatch] (Windows SysInternals) Process Explorer v14.1 released
2005.08 [sans] Slow Sunday; CA Message Queuing Vulns; Process Explorer Vuln; Infocon: Green Redux

<a id="836a3b7a9763957991fce4355439ad06"></a>其他

<a id="17fd6ceec67d0beed0bf54b117218123"></a>工具

<a id="ed25f17a9dd8092131cf45121e24aa68"></a>文章

2019.11 [code610] Sysinternals Suite - quick review for Windows 10
2018.01 [hexacorn] Yet another way to hide from Sysinternals’ tools, part 1.5
2018.01 [hexacorn] 利用"环境变量"躲避 Sysinternals 工具检测的另类方式. Autoruns/ProcessExplorer 均无法检测到使用此方式设置的自启动项
2017.10 [360] 如何利用SysInternals Suite来隐藏你的进程
2017.08 [chrislazari] Removing Crypto-Mining Malware from Windows using SysInternals Tools
2016.11 [hackers] Digital Forensics, Part 8: Live Analysis with sysinternals
2015.11 [holisticinfosec] toolsmith #110: Sysinternals vs Kryptic
2014.11 [hexacorn] Sysinternals’ Eulagoogoolizer
2014.07 [lowleveldesign] Collect .NET applications traces with sysinternals tools
2011.04 [toolswatch] New Sysinternals Suite Available
2011.04 [pediy] [翻译]The Case of the Sysinternals-Blocking Malware——虚拟桌面程序来协助你手动杀毒
2011.04 [toolswatch] Analyzing a Stuxnet Infection with the Sysinternals Tools, Part 1
2011.03 [toolswatch] (Windows SysInternals) VMMap v3.03 released
2011.03 [toolswatch] (Windows SysInternals) ProcDump v3.03 released
2009.12 [sans] Updates to Sysinternals Toolkit
2009.09 [sans] Sysinternals Tools Updates
2009.05 [sans] Sysinternals Updates 3 Applications
2008.10 [sans] Updates to SysInternals tools!
2008.07 [pediy] [原创]Sysinternal出品工具TcpView的驱动逆向源代码
2006.07 [sans] Winternals/SysInternals acquired by Microsoft

<a id="b478e9a9a324c963da11437d18f04998"></a>工具

<a id="f9fad1d4d1f0e871a174f67f63f319d8"></a>新添加的

[9553星][9d] [PS] lukesampson/scoop A command-line installer for Windows.
[4868星][10m] [Py] 10se1ucgo/disablewintracking Uses some known methods that attempt to minimize tracking in Windows 10
[3648星][9d] [C#] kohsuke/winsw A wrapper executable that can be used to host any executable as an Windows service, in a liberal license
[3409星][1m] [C] microsoft/windows-driver-samples This repo contains driver samples prepared for use with Microsoft Visual Studio and the Windows Driver Kit (WDK). It contains both Universal Windows Driver and desktop-only driver samples.
[3222星][9d] [C++] 0xz0f/z0fcourse_reverseengineering Reverse engineering focusing on x64 Windows.
[2132星][2m] [C++] darthton/blackbone Windows memory hacking library
[2052星][1m] [C++] mhammond/pywin32 Python for Windows (pywin32) Extensions
[700星][9d] [PS] farag2/windows-10-setup-script Windows 10 1903/1909 自动化配置脚本
[666星][28d] [C] virtio-win/kvm-guest-drivers-windows KVM / QEMU Windows来宾驱动程序
[628星][3m] [C] mrexodia/titanhide 用于隐藏某些进程调试器的驱动程序
[278星][1y] [Py] hakril/pythonforwindows 简化Python与Windows操作系统交互的库
[216星][5m] adguardteam/adguardforwindows Windows系统范围的AdBlocker

<a id="6d2fe834b7662ecdd48c17163f732daf"></a>Environment&&环境&&配置

[1530星][1y] [PS] joefitzgerald/packer-windows 使用Packer创建Vagrant boxes的模板
[1368星][3m] [Go] securitywithoutborders/hardentools 禁用许多有危险的Windows功能
[1167星][11d] [HTML] nsacyber/windows-secure-host-baseline Windows 10和Windows Server 2016 DoD 安全主机基准设置的配置指南
[1054星][9d] adolfintel/windows10-privacy Win10隐私指南
[545星][11d] [PS] stefanscherer/packer-windows Windows Packer 模板：Win10, Server 2016, 1709, 1803, 1809, 2019, 1903, Insider with Docker

<a id="c3cda3278305549f4c21df25cbf638a4"></a>内核&&驱动

[943星][11m] [C] microsoft/windows-driver-frameworks Windows驱动框架(WDF)
[891星][1m] axtmueller/windows-kernel-explorer Windows内核研究工具
[515星][7m] [Py] rabbitstack/fibratus Windows内核探索和跟踪工具
[496星][3m] [C] jkornev/hidden Windows驱动，带用户模式接口：隐藏文件系统和注册表对象、保护进程等
[288星][9d] [PS] microsoftdocs/windows-driver-docs 官方Windows驱动程序工具包文档

<a id="920b69cea1fc334bbc21a957dd0d9f6f"></a>注册表

[521星][9d] [Batchfile] chef-koch/regtweaks Windows注册表调整（Win 7-Win 10）
[293星][2m] [Py] williballenthin/python-registry 用于对Windows NT注册表文件进行纯读取访问的Python库

<a id="d295182c016bd9c2d5479fe0e98a75df"></a>系统调用

[757星][4m] [HTML] j00ru/windows-syscalls Windows 系统调用表(NT/2000/XP/2003/Vista/2008/7/2012/8/10)
[349星][20d] [C] hfiref0x/syscalltables Windows NT x64系统调用表

<a id="1afda3039b4ab9a3a1f60b179ccb3e76"></a>其他

[1007星][12d] [C++] henrypp/simplewall 为Windows 过滤平台提供的配置界面
[981星][5m] [C] basil00/divert 用户模式数据包拦截库，适用于Win 7/8/10
[742星][4m] [Py] diyan/pywinrm Python实现的WinRM客户端
[605星][21d] [C] hfiref0x/winobjex64 Windows对象浏览器. x64
[475星][2m] [C#] microsoft/dbgshell PowerShell编写的Windows调试器引擎前端
[428星][12d] [C] samba-team/samba 适用于Linux和Unix的标准Windows interoperability程序套件
[412星][2m] [Jupyter Notebook] microsoft/windowsdefenderatp-hunting-queries 在MS Defender ATP中进行高级查询的示例
[396星][16d] [C#] microsoft/binskim 二进制静态分析工具，可为PE和ELF二进制格式提供安全性和正确性分析
[377星][2m] [Ruby] winrb/winrm 在Windows中使用WinRM的功能调用原生对象的SOAP库。Ruby编写

<a id="3939f5e83ca091402022cb58e0349ab8"></a>文章

<a id="8e1344cae6e5f9a33e4e5718a012e292"></a>新添加

2018.11 [vimeo] INNUENDO Telemetry Gathering and Incidence Response
2018.01 [4sysops] Search Active Directory with the PowerShell cmdlet Get‑ADComputer
2017.06 [faiz] #CloudComputing : #Security, #Vulnerabilities, #Privacy, #Storage, #Multicloud Overview SERIES #1
2017.03 [paloaltonetworks] Pulling Back the Curtains on EncodedCommand PowerShel
2017.02 [vexillium] Windows Kernel Local Denial-of-Service #2: win32k!NtDCompositionBeginFrame (Windows 8-10)
2017.02 [vexillium] Windows Kernel Local Denial-of-Service #2: win32k!NtDCompositionBeginFrame (Windows 8-10)
2017.01 [trustedsec] Circumventing EncodedCommand and IEX Detection in PowerShell
2013.11 [mikefrobbins] Windows 8.1 RSAT PowerShell Cmdlets Get-ADUser & Get-ADComputer : One or more Properties are Invalid

贡献

内容为系统自动导出, 有任何问题请提issue

Awesome

所有收集类项目

Windows

目录

<a id="686597a4cff20c60a8e86116cde645fb"></a>PowerShell

<a id="c65ce176ec6f9bbce520d5b97f4067db"></a>PowerSploit

<a id="65a67d0db02390cee295385191ee5ee0"></a>工具

<a id="0ab243d6d9d07fd24d8aa9a44ea03e89"></a>文章

<a id="7a02de4887610ec52c49e64b95fe1580"></a>PSAttack

<a id="65edc029f91b76eab19a2adb39966d55"></a>工具

<a id="5f6fc3b3e1eac08f477163970696725e"></a>文章

<a id="f00255b09a7cea498b2672c2c7447a04"></a>其他

<a id="882141dceab035af73809b75c83477f1"></a>工具

<a id="06d2309e0637f481cdfac132c86142b3"></a>文章

<a id="89f963773ee87e2af6f9170ee60a7fb2"></a>DLL

<a id="4dcfd9135aa5321b7fa65a88155256f9"></a>新添加

<a id="9753a9d52e19c69dc119bf03e9d7c3d2"></a>工具

<a id="b05f4c5cdfe64e1dde2a3c8556e85827"></a>文章

<a id="3b4617e54405a32290224b729ff9f2b3"></a>DLL注入

<a id="b0d50ee42d53b1f88b32988d34787137"></a>工具

<a id="1a0b0dab4cdbab08bbdc759bab70dbb6"></a>文章

<a id="f39e40e340f61ae168b67424baac5cc6"></a>DLL劫持

<a id="c9cdcc6f4acbeda6c8ac8f4a1ba1ea6b"></a>工具

<a id="01e95333e07439ac8326253aa8950b4f"></a>文章

<a id="7f17d2efd0021063bd713a1b9ee2f46e"></a>DLL旁加载

<a id="ec3149509e7612fb1a2126948f141bc0"></a>文章

<a id="620af0d32e6ac1f4a3e97385d4d3efc0"></a>PE

<a id="c9d6674c5ab3d9adb7fd295acb7ba7cf"></a>PE解析

<a id="3cb6b6d0c5f183fc7beed42c26733e39"></a>工具

<a id="f644a8855d53c26fb4f9799d2733c8c8"></a>文章

<a id="574db8bbaafbee72eeb30e28e2799458"></a>工具

<a id="c364a31b0a48b1a528f728def1d3ca05"></a>工具

<a id="7e890d391fa32df27beb1377a371518b"></a>文章

<a id="bba6a2ee17956c3bd688c16acac5e502"></a>文章

<a id="b8c834b16722c108f8c30f1b0190f0a1"></a>.NET

<a id="d90b60dc79837e06d8ba2a7ee1f109d3"></a>工具

<a id="6b8b4bf156e5f973cf0485d45a94f4c4"></a>新添加

<a id="e26e6693fc840e27099c4363598e02cc"></a>dnspy

<a id="2612f712f9363ad0d71fc054c4829396"></a>文章

<a id="5dc38e490615f91e67ffb2f668c5088a"></a>登录与认证

<a id="360af8f1497fcc2dfd2e32f2b636d718"></a>Mimikatz

<a id="17f92a061cc661a040c094c1b3fd32e3"></a>工具

<a id="c9617bf44965290de6f7b645c15328ea"></a>文章

<a id="37557d58c549b4988bf0bb0ada5de975"></a>NTLM

<a id="6c8194db98591f8f68b790975663bc5a"></a>工具

<a id="f07067c1b70f9c002838e2f4ab25da7d"></a>文章

<a id="20f86e3e6a4aa7dc1e5a1e3071e0d500"></a>Kerberos

<a id="fbc6987a538d971f3d85b790fbf0c1e1"></a>工具

<a id="3a746419a4bc22b8a6425b81b6bd4593"></a>文章

<a id="2e1fd273eb428694a94396509754acb5"></a>Pass-The-Hash

<a id="3efc90b9ae87a405e231900020ea33ed"></a>工具

<a id="5cbd82fde4af3da6516b88c52d2c357a"></a>文章

<a id="af48434aafea8db423a9bacef64b1620"></a>Pass-The-Ticket

<a id="e335ccf1622ee0d95b75a4cbb0af5a32"></a>文章

<a id="fe064b8a783e94169307579efcfc5349"></a>winglogon.exe

<a id="1e77e9449ab3be5cd9977aa55991c897"></a>工具

<a id="6d3a0fcab4e6b1199600072b17f941b0"></a>文章

<a id="9813233777717d99ef29e2fe63abfefb"></a>LLMNR

<a id="7658d2242abc5b8c24e80a77b3a89321"></a>工具

<a id="e4227d4373c3aec808349a26c979c522"></a>文章

<a id="d6fd46f65ce1fe687a92a2da9551d7a9"></a>NetBIOS

<a id="e41f70bc9d7ba0f1430bed63e2d9aece"></a>工具

<a id="ce06393f8c683c74ea341a9ef2b48938"></a>文章

<a id="cd40abc5c7d4b2907b770e53a60ee3ec"></a>其他

<a id="e522f8282206b84cd670cbb658e4bd75"></a>工具

<a id="cbdc1e0b908c8f2df368db8bbc65926f"></a>安全防护

<a id="40fd1488e4a26ebf908f44fdcedd9675"></a>UAC

<a id="02517eda8c2519c564a19219e97d6237"></a>工具

<a id="90d7d5feb7fd506dc8fd6ee0d7e98285"></a>文章

<a id="184bbacd8b9e08c30cc9ffcee9513f44"></a>AppLocker

<a id="8f1876dff78e80b60d00de25994276d9"></a>工具

<a id="286317d6d7c1a0578d8f5db940201320"></a>文章

<a id="fa89526db1f9373c57ea4ffa1ac8c39f"></a>Data Execution Prevention(DEP)

<a id="10252fd90a09cb32b4e82497aa79f037"></a>工具

<a id="5ff9992a2474eb75e2a1b5860d5b87dc"></a>文章

<a id="edd6035c85e4ddf47939cc0e21505089"></a>Patch Guard(PG)

<a id="928f69b989fa9e8ec3436e361f646eac"></a>工具

<a id="998ed9d8013051b3c7b21b89d189d509"></a>文章

<a id="9820fc65cd69d9d295a81cfd90be12fe"></a>Driver Signature Enforcement(DSE)

<a id="18cbac58652453abbe2ff1aed187d370"></a>工具