Its been on my todo list for the past 2+ years to clear out this backlog. I don't see any point in keeping any of this non-public, used to care as people love to make assumptions and talk shit, but hey, at this point, I'm posting poltical messages.
To be clear, I will sort this backlog and integrate + reform the RT.md page.

This is just to make this available to help people. (Blue & Red)



* **Campaigns, Actors & Strains**
		101
			https://github.com/blackorbird/APT_REPORT/blob/master/summary/2023/360_APT_Annual_Research_Report_2022.pdf
			https://www.youtube.com/watch?v=GKK0ZS07neY&list=PLXF21PFPPXTOZ9LsDnCTY0tfio0uxRz41&index=18
			https://www.youtube.com/watch?v=JiUG9jhOILE
			https://www.vbs.admin.ch/content/vbs-internet/en/vbs/organisation-des-vbs/die-verwaltungseinheiten-des-vbs/-der-nachrichtendienst-des-bundes/_jcr_content/contentPar/tabs/items/dokumente_und_publik/tabPar/downloadlist_2015528307/downloadItems/272_1675096020796.download/NDB-Technopol-Broschuere-e.pdf?utm_source=substack&utm_medium=email
			https://www.huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victims?utm_source=substack&utm_medium=email
			https://www.welivesecurity.com/wp-content/uploads/2023/01/eset_apt_activity_report_t32022.pdf
			https://www.microsoft.com/en-us/security/blog/2023/04/11/dev-0196-quadreams-kingspawn-malware-used-to-target-civil-society-in-europe-north-america-the-middle-east-and-southeast-asia/?utm_source=substack&utm_medium=email
			https://www.youtube.com/watch?app=desktop&v=xCU47bJoLho
			https://www.elastic.co/blog/elastic-global-threat-report-breakdown-defense-evasion
			https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf
			https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf
			https://www.secureworks.com/blog/counter-threat-unit-researchers-publish-threat-group-definitions
			https://adversary.crowdstrike.com
			https://www.zdnet.com/article/google-reveals-sophisticated-windows-android-hacking-operation/
			https://blog.google/threat-analysis-group/analyzing-watering-hole-campaign-using-macos-exploits/
			https://www.youtube.com/watch?v=4JVrK7bRKb0
			https://decoded.avast.io/janvojtesek/backdoored-browser-extensions-hid-malicious-traffic-in-analytics-requests/
			https://www.youtube.com/watch?v=BDzw9cGEJos&list=PLXF21PFPPXTMmtx0XBXqjxSMZSipIMXwX&index=4
			https://www.youtube.com/watch?v=Yii6JQHyaeU&list=PLmv8T5-GONwQq16OhfaU77KCq7UQGiZsr&index=2
			https://www.irongeek.com/i.php?page=videos/bsidescleveland2018/b06-anatomy-of-an-attack-john-fatten
		Acidbox
			https://unit42.paloaltonetworks.com/acidbox-rare-malware/
		Adder
			https://www.irongeek.com/i.php?page=videos/nolacon2018/nolacon-2018-100-chasing-the-adder-a-tale-from-the-apt-world-stefano-maccaglia
		Africa
			https://www.youtube.com/watch?v=MDPlm-HWtXg&list=PL7ZDZo2Xu330gMHAoeGvH9QkCJMC-qgeK&index=6
		Amadey
			https://krabsonsecurity.com/2019/02/13/analyzing-amadey-a-simple-native-malware/
			https://blog.talosintelligence.com/2021/08/raccoon-and-amadey-install-servhelper.html?m=1
		APT19
			https://cybergeeks.tech/analyzing-apt19-malware-using-a-step-by-step-method/
		APT28/Skinnyboy
			https://marcoramilli.com/2021/12/30/apt28-skinnyboy-cheat-sheet/
			https://threatvector.cylance.com/en_us/home/flirting-with-ida-and-apt28.html
			https://threatvector.cylance.com/en_us/home/inside-the-apt28-dll-backdoor-blitz.html
		APT29
			https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html
		APT31
			https://research.checkpoint.com/2021/the-story-of-jian/
				https://fullpwnops.com/apt31-dropper-targets-russia/
		APT32
			https://labs.sentinelone.com/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/
		APT39
			https://blogs.360.cn/post/APT-C-39_CIA_EN.html
		APT41
			https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/
			https://www.darktrace.com/en/blog/catching-apt-41-exploiting-a-zero-day-vulnerability/
		APT43
			https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/
		ASyncRat
			https://blog.morphisec.com/asyncrat-new-delivery-technique-new-threat-campaign
		Australia
			https://securityaffairs.co/wordpress/81677/malware/australian-parliament-hack-malware.html
		Bahamut
			https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf
		Bandook
			https://www.welivesecurity.com/2021/07/07/bandidos-at-large-spying-campaign-latin-america/
		batloader
			https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html
		bayside
			https://krabsonsecurity.com/2017/09/16/bayside-rat-analysis/
		BendyBear
			https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/
		BerserkBear
			https://vblocalhost.com/presentations/the-baffling-berserk-bear-a-decades-activity-targeting-critical-infrastructure/?key=6KXGCJOMis8X
		Blackmatter
			https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackmatter-data-exfiltration
		BleedingBear
			https://elastic.github.io/security-research/malware/2022/01/01.operation-bleeding-bear/article/
		Blindingcan
			https://blogs.jpcert.or.jp/en/2020/09/BLINDINGCAN.html
		Brunhilda
			https://raw.githubusercontent.com/prodaft/malware-ioc/master/BrunhildaProject/BrunHilda_DaaS.pdf
		Carbanak
			https://www.trendmicro.com/en_us/research/21/d/carbanak-and-fin7-attack-techniques.html
		Chimera
			https://www.youtube.com/watch?v=gQ3Djw3Tl1g&list=PLH15HpR5qRsXE_4kOSy_SXwFkFQre4AV_&index=20
			https://hack.click/recordings/thursday/forensics/operation-chimera---apt-operation-targets-semiconductor-vendors.html
		China
			https://xorl.wordpress.com/2021/04/20/chinese-cyber-operations-groups/
			https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-defenders-blog-operation-dianxun/
			https://blog.confiant.com/malvertising-made-in-china-f5081521b3f0?gi=268c0217e2d1
			https://www.recordedfuture.com/chinese-state-sponsored-cyber-espionage-expansion-power-influence-southeast-asia/
			https://www.nortonlifelock.com/sites/default/files/2021-10/OPERATION%20EXORCIST%20White%20Paper.pdf
			https://www.recordedfuture.com/chinese-group-tag-22-targets-nepal-philippines-taiwan/
		Cinarat
			https://blog.morphisec.com/cinarat-resurfaces-with-new-evasive-tactics-and-techniques
		Collector-stealer
			https://www.virusbulletin.com/blog/2021/12/new-paper-collector-stealer-russian-origin-credential-and-information-extractor/
		Crunchyroll
			https://krabsonsecurity.com/2017/11/04/analysis-of-the-crunchyroll-malware/
		CS
			https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/
			https://michaelkoczwara.medium.com/cobalt-strike-hunting-aefe1c5d1ec5
		Dark Caracal
			https://www.youtube.com/watch?v=7X0D2gX1PD0
			https://www.youtube.com/watch?v=8F9HhIgiz8I
		Deathstalker
			https://securelist.com/deathstalker-mercenary-triumvirate/98177/
		Deimos
			https://squiblydoo.blog/2021/05/02/mars-deimos-solarmarker-jupyter-infostealer-part-1/
		Domestic Kitten
			* https://research.checkpoint.com/2021/domestic-kitten-an-inside-look-at-the-iranian-surveillance-operations/
		Donot
			https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/
		Doppel
			https://www.armor.com/resources/threat-intelligence/the-evolution-of-doppel-spider-from-bitpaymer-to-grief-ransomware/
		DragonSpark
			https://www.sentinelone.com/labs/dragonspark-attacks-evade-detection-with-sparkrat-and-golang-source-code-interpretation
		Dridex
			https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/
		Drovorub
			https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF
		Duqu
			https://securelist.com/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/70504/
			https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205202/The_Mystery_of_Duqu_2_0_a_sophisticated_cyberespionage_actor_returns.pdf
		Egregor
			* [Egregor – Prolock: Fraternal Twins ? - Jean Bichet(2020)](https://github.com/UnkL4b/BabyShark)
		Electrorat
			https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
		Emotet
			https://unit42.paloaltonetworks.com/emotet-command-and-control/
			https://hello.global.ntt/en-us/insights/blog/behind-the-scenes-of-the-emotet-infrastructure
		Enigma
			https://www.trendmicro.com/en_us/research/23/b/enigma-stealer-targets-cryptocurrency-industry-with-fake-jobs.html
		EquationGroup
			https://securelist.com/darkpulsar/88199/
		facefish
			https://blog.netlab.360.com/ssh_stealer_facefish_en/
		FIN13
			https://www.mandiant.com/resources/fin13-cybercriminal-mexico
		Finspy
			https://cyberworkx.in/2021/09/29/malware-campaign-hijacking-windows-uefi-bootloader-to-infect-victims/
			https://securelist.com/finspy-unseen-findings/104322/
			https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319	
		Frenchy
			http://www.peppermalware.com/2019/07/analysis-of-frenchy-shellcode.html#moreus-15-Pitts-Repurposing-OnionDuke-A-Single-Case-Study-Around-Reusing-Nation-State-Malware-wp.pdf
		Gamma
			https://blog.talosintelligence.com/2021/02/gamaredonactivities.html
		GhostEmperor
			https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/
		Gold
			https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
		gootloader
			https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/
			https://securelist.com/gootkit-the-cautious-trojan/102731/
		Guerrero-Saade
			https://www.virusbulletin.com/uploads/pdf/magazine/2018/VB2018-Guerrero-Saade.pdf
		Hafnium
			https://www.picussecurity.com/resource/blog/ttps-hafnium-microsoft-exchange-servers
		Hamas
			https://www.atlanticcouncil.org/in-depth-research-reports/report/the-cyber-strategy-and-operations-of-hamas-green-flags-and-green-hats/
		Hancitor
			https://thedfirreport.com/2021/06/28/hancitor-continues-to-push-cobalt-strike/
		Hangover
			https://unit42.paloaltonetworks.com/threat-assessment-hangover-threat-group/
		Invisimole
			https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf
		Iran
			https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
		Iron Tiger
			https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html
		jian
			https://research.checkpoint.com/2021/the-story-of-jian/
		JSSloader
			https://www.morphisec.com/hubfs/eBooks_and_Whitepapers/FIN7%20JSSLOADER%20FINAL%20WEB.pdf
		Jupyter
			https://blog.morphisec.com/new-jupyter-evasive-delivery-through-msi-installer
		Klingon rat
			https://www.intezer.com/blog/malware-analysis/klingon-rat-holding-on-for-dear-life/
		Kronos
			https://www.zscaler.com/blogs/security-research/ares-malware-grandson-kronos-banking-trojan
		Lambert
			https://github.com/RedDrip7/APT_Digital_Weapon/blob/master/Lamberts/README.md
		Lazarus
			https://blogs.jpcert.or.jp/en/2021/03/Lazarus_malware3.html
			https://www.bleepingcomputer.com/news/security/op-sharpshooter-connected-to-north-koreas-lazarus-group/
			https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/
			https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/
			https://www.youtube.com/watch?v=NEjVJsKeV5k
			https://www.virusbulletin.com/blog/2019/06/vb2018-paper-lazarus-group-mahjong-game-played-different-sets-tiles/
			https://blog.malwarebytes.com/malwarebytes-news/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/
		Lightneuron
			https://cdn1.esetstatic.com/ESET/US/resources/white-papers/ESET_Lightneuron_WP.pdf
		Lockfile
			https://www.csoonline.com/article/3631517/lockfile-ransomware-uses-intermittent-encryption-to-evade-detection.html
		Lokibot
			https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html
		LuckyMouse
			https://www.welivesecurity.com/2020/12/10/luckymouse-ta428-compromise-able-desktop/
		LuminousMouth
			https://securelist.com/apt-luminousmoth/103332/
		Malay
			https://www.elastic.co/blog/advanced-techniques-used-in-malaysian-focused-apt-campaign
		Manticore
			https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/
		Mekotio
			https://research.checkpoint.com/2021/mekotio-banker-returns-with-improved-stealth-and-ancient-encryption/
		Metador
			https://www.sentinelone.com/labs/the-mystery-of-metador-an-unattributed-threat-hiding-in-telcos-isps-and-universities
			https://www.youtube.com/watch?v=cVneyubdLiE&list=PLUzWZANghr3bfJ3teu-bvdAZJzmU0g4iY&index=7
			https://www.sentinelone.com/labs/the-mystery-of-metador-an-unattributed-threat-hiding-in-telcos-isps-and-universities/
			https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/mobilebasic#heading=h.iexryfpllo8g
		Minibridge
			https://www.zscaler.com/blogs/security-research/return-minebridge-rat-new-ttps-and-social-engineering-lures
		MoltedSkin
			https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/
		Moonbounce
			https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/01/19115831/MoonBounce_technical-details_eng.pdf
		MuddyWaters
			https://securelist.com/muddywaters-arsenal/90659/
			https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/muddy-advanced-persistent-teacher.html
		Nightscout
			https://www.welivesecurity.com/2021/02/01/operation-nightscout-supply-chain-attack-online-gaming-asia/
		NOBELIUM
			https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
		North Korea
			https://www.cisa.gov/uscert/ncas/alerts/aa20-239a
			https://research.nccgroup.com/2022/05/05/north-koreas-lazarus-and-their-initial-access-trade-craft-using-social-media-and-social-engineering/
		nymaim
			https://arielkoren.com/blog/2016/11/02/nymaim-deep-technical-dive-adventures-in-evasive-malware/
		OILRIG
			https://www.trapx.com/wp-content/uploads/2021/01/A0A_Report_TrapX_Nation_State_Attack.pdf
			https://securityaffairs.co/wordpress/89586/apt/oilrig-apt-techniques-evolution.html
			https://misterch0c.blogspot.com/2019/04/apt34-oilrig-leak.html
		OpenSU
			https://blog.google/threat-analysis-group/financially-motivated-actor-breaks-certificate-parsing-avoid-detection/
		Patchwork
			https://blog.malwarebytes.com/threat-intelligence/2022/01/patchwork-apt-caught-in-its-own-web/
		PlugX
			https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/
		Plurox
			https://securelist.com/plurox-modular-backdoor/91213/
		Powerfall
			https://securelist.com/operation-powerfall-cve-2020-0986-and-variants/98329/
		Pymropsim
			https://unit42.paloaltonetworks.com/pymicropsia/
		Qakbot
			https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/
			https://www.vkremez.com/2018/07/lets-learn-in-depth-reversing-of-qakbot.html
			https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
		Ramsay
			https://www.youtube.com/watch?v=SKIu4LqMrns
		Ransomware
			https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates/
			https://blog.morphisec.com/decaf-ransomware-a-new-golang-threat-makes-its-appearance
			https://research.checkpoint.com/2020/ransomware-alert-pay2key/
			https://practicalsecurityanalytics.com/how-to-emulate-a-ransomware-attack/
			https://modexp.wordpress.com/2017/05/15/wanacryptor/
			https://fullpwnops.com/teslacrypt-ransomware/
			https://krabsonsecurity.com/2019/01/07/static-crypt/
			https://krabsonsecurity.com/2017/10/31/prime-crypt-the-latest-in-false-advertising-and-poorly-coded-crapware/
		RaspberryRobin
			https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-raspberry-robin?utm_source=substack&utm_medium=email
		Remcos
			https://labs.bitdefender.com/2021/01/remcos-rat-revisited-a-colombian-coronavirus-themed-campaign/
			https://krabsonsecurity.com/2018/03/02/analysing-remcos-rats-executable/
		Revenge Rat
			https://www.uptycs.com/blog/revenge-rat-targeting-users-in-south-america
		RoyalRoad
			https://nao-sec.org/2021/01/royal-road-redive.html
		Russia
			https://www.advintel.io/post/storm-in-safe-haven-takeaways-from-russian-authorities-takedown-of-revil
			https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/
			https://www.intel471.com/blog/cybercrime-russia-china-iran-nation-state
		Ryuuk
			https://www.advanced-intel.com/post/crime-laundering-primer-inside-ryuk-crime-crypto-ledger-risky-asian-crypto-traders
			* [STAR Webcast: Spooky RYUKy: The Return of UNC1878](https://www.youtube.com/watch?v=BhjQ6zsCVSc)
				* Earlier this year, Mandiant published a blog on a fast-moving adversary deploying RYUK ransomware, UNC1878. Shortly after its release, there was a significant decrease in observed UNC1878 intrusions and RYUK activity overall almost completely vanishing over the summer. But beginning in early fall, Mandiant has seen a resurgence of RYUK along with TTP overlaps indicating that UNC1878 has returned from the grave and resumed their operations. Fear not! In this webcast presenters will cover recent RYUK activity, its attribution to UNC1878, and TTPs both old and new to aid defenders in detection and response.
		Sauron
			https://malpedia.caad.fkie.fraunhofer.de/actor/projectsauron
			https://usa.kaspersky.com/about/press-releases/2021_ghostemperor-apt-targets-high-profile-victims-using-unknown-rootkit
			https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/
		Scattered Spider
			https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud
		ShadowPad
			https://www.pwc.co.uk/issues/cyber-security-services/research/chasing-shadows.html
			https://www.sentinelone.com/labs/shadowpad-a-masterpiece-of-privately-sold-malware-in-chinese-espionage/
		Silver Fish
			* [SilverFish GroupThreat Actor Report - Prodaft TI(2021)](https://www.prodaft.com/m/uploads/SilverFish_TLPWHITE.pdf)
		Silver Sparrow
			https://redcanary.com/blog/clipping-silver-sparrows-wings/
		Sodinokibi
			https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
		SolarWinds
			https://thehackernews.com/2021/03/solarwinds-orion-vulnerability.html
			https://github.com/CyberSecOps/SolarWinds-Sunburst-Solorigate-Supernova-FireEye
			https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware
			https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
			https://www.fireeye.com/blog/threat-research/2020/12/sunburst-additional-technical-details.html
			https://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal/
		Solorigate
			https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
		SpoofedScholars
			https://www.proofpoint.com/us/blog/threat-insight/operation-spoofedscholars-conversation-ta453
		SquirrelWaffle
			https://blog.talosintelligence.com/2021/10/squirrelwaffle-emerges.html
		StellarParticle
			https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/
		STRRat
			https://isc.sans.edu/diary/rss/27798
		Sunburst
			https://www.fireeye.com/blog/threat-research/2020/12/sunburst-additional-technical-details.html
			https://www.atlanticcouncil.org/in-depth-research-reports/report/broken-trust-lessons-from-sunburst/#executivesummary
		Sunspot
			https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/
		Sysjoker
			https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/
		Sysrv
			https://cujo.com/the-sysrv-botnet-and-how-it-evolved/
		TA410
			https://www.proofpoint.com/us/blog/threat-insight/ta410-group-behind-lookback-attacks-against-us-utilities-sector-returns-new
		TA428
			https://vblocalhost.com/presentations/where-is-the-cuckoo-egg/?key=d0hy0FejQKNG
		TA505
			https://research.nccgroup.com/2020/11/18/ta505-a-brief-history-of-their-time/
		TransparentTribe
			https://securelist.com/transparent-tribe-part-1/98127
			https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html
		TrapX
			https://www.trapx.com/wp-content/uploads/2021/01/A0A_Report_TrapX_Nation_State_Attack.pdf
		Trickbot
			https://www.wired.co.uk/article/trickbot-malware-group-internal-messages
			https://www.gosecure.net/blog/2021/12/03/trickbot-leverages-zoom-work-from-home-interview-malspam-heavens-gate-and-spamhaus/
		Turla
			https://blog.talosintelligence.com/2021/09/tinyturla.html
			https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
			https://www.trendmicro.com/en_us/research/23/i/examining-the-activities-of-the-turla-group.html
			* [IronNetInjector: Turla’s New Malware Loading Tool - Dominik Reichel(2021)](https://unit42.paloaltonetworks.com/ironnetinjector/)
			* [Turla: In and out of its unique Outlook backdoor - Tomas Foltyn](https://www.welivesecurity.com/2018/08/22/turla-unique-outlook-backdoor/)
				* The latest ESET research offers a rare glimpse into the mechanics of a particularly stealthy and resilient backdoor that the Turla cyberespionage group can fully control via PDF files attached to emails
		UNC1945
			https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html
		URSnif
			https://arielkoren.com/blog/2016/11/01/ursnif-malware-deep-technical-dive/
		USA
			https://cybergeeks.tech/revealing-the-lamberts-malware-using-a-step-by-step-approach-cyberespionage-group-linked-to-vault-7/
			https://cyware.com/news/purple-lambert-a-new-malware-of-cia-linked-lambert-apt-group-8d25e294
			https://therecord.media/security-firm-kaspersky-believes-it-found-new-cia-malware/
			https://securelist.com/unraveling-the-lamberts-toolkit/77990/
			https://twitter.com/F4rmP0et/status/1479495721460109320
			https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-attempt-of-2003/
		Void
			https://documents.trendmicro.com/assets/white_papers/wp-void-balaur-tracking-a-cybermercenarys-activities.pdf
		WastedLocker
			https://news.sophos.com/en-us/2020/08/04/wastedlocker-techniques-point-to-a-familiar-heritage/
		Wildpressure
			https://securelist.com/wildpressure-targets-macos/103072/
		Windealer
			https://blogs.jpcert.or.jp/en/2021/10/windealer.html
		WizardOpium
			https://www.blackhat.com/docs/us-15/materials/
			https://securelist.com/the-zero-day-exploits-of-operation-wizardopium/97086/
		WSlink
			https://www.welivesecurity.com/2021/10/27/wslink-unique-undocumented-malicious-loader-runs-server/
		XDSpy
			https://www.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011/
		Zebrocy APT
		Zeoticus
			https://labs.sentinelone.com/zeoticus-2-0-ransomware-with-no-c2-required/
		Zeus
			https://christian-rossow.de/publications/zeusmilker-icdcs2015.pdf
		Zirconium
			https://imp0rtp3.wordpress.com/2021/11/25/sowat/
		ZLoader
			https://research.checkpoint.com/2022/can-you-trust-a-files-digital-signature-new-zloader-campaign-exploits-microsofts-signature-verification-putting-users-at-risk/
			https://medium.com/walmartglobaltech/signed-dll-campaigns-as-a-service-7760ac676489
			https://blog.malwarebytes.com/threat-analysis/2020/05/the-silent-night-zloader-zbot/
	Linux APTs
		https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/
	* [RedSourcing: Cyber War Tool Development Outsourcing - Christopher Glyer, Nick Carr(RedTeamVillage2020)](https://www.youtube.com/watch?v=tA37b7kOBy8&list=PLruly0ngXhPGvyl-gOp4d_TvIiedloX1l&index=8&t=0s)


General
	* [Are We Helping? - Jackson T (2024)](https://jackson-t.com/are-we-helping/)
	* [USMC Red Team Handbook](https://usacac.army.mil/sites/default/files/documents/ufmcs/The_Red_Team_Handbook.pdf)
	* [Red Team Capability Maturity Model](https://github.com/BCHarrell/redteamcmm)
		* "This GitHub is primarily for managing community input and also provides the CMM in two file formats - Excel, if you trust me and want some formatting already done for you; and CSV, if you want to do some formatting yourself and think I'm sketchy. For the full model in your browser and other supporting information, see the project website."
		* [Main Site](https://www.redteammaturity.com/)
	* [Why Managing Nuance Matters for Red Teams - Jackson T. (2022)](https://jackson-t.com/why-managing-nuance-matters-for-red-teams/)
	* [OPSEC-Tradecraft- WesleyWong420](https://github.com/WesleyWong420/OPSEC-Tradecraft)
	* [Helpful Principles in Adversarial Operations - Dan Borges(Defcon RTV30)](https://www.youtube.com/watch?v=XmpkqX2pd5g)
	* [Indicator of Canary](https://github.com/HackingLZ/IndicatorOfCanary)
		* The Indicator of Canary is a collection of PoCs from research on identifying canaries in various file formats. It focuses on identifying known IoCs(Indicator of Canary) and unknown callback URLs in places they shouldn't be. Ultimately, this will give operators better awareness and make more informed decisions, preferably by automating similar checks in implants and other tools.
	* [Why Most Red Teams are Really Pentesters - CX01N(2022)](https://bc-security.org/why-most-red-teams-are-really-pentesters/)
	* [Red Team? Or EDR Bypass Team - redteamdispatch(2022)](https://dispatch.redteams.fyi/red-team-edr-bypass-team/)

Adv Emu/Simu
	* [Adversary Emulation vs Simulation - Dan Borges(2022)](https://lockboxx.blogspot.com/2022/01/adversary-emulation-vs-simulation.html)	

Attack Intel

Building a redteam
	* [The Red Teamer's Guide To Building A Program - Daniel Marques(2022)](https://speakerdeck.com/0xc0da/the-red-teamers-guide-to-building-a-program)
	(5 Steps to Building a Modern Red Team Program - safebreach(2022)](https://www.safebreach.com/blog/5-steps-to-building-a-modern-red-team-program/)


BYOI

C2
	https://gitlab.com/badsectorlabs/iscariot-suite
	https://github.com/morph3/Windows-RPC-Backdoor/tree/main/Windows_RPC_Backdoor
	- C
		* [Maelstrom - mez0](https://web.archive.org/web/20221106170044/https://mez0.cc/posts/maelstrom/)
		* [Azure Outlook C2](https://github.com/boku7/azureOutlookC2)
		* [Micro Backdoor](https://github.com/Cr4sh/MicroBackdoor)
			* Micro Backdoor is C2 tool for Windows targets with easy customizable code base and small footprint. Micro Backdoor consists from server, client and dropper. It wasn't designed as replacement for your favorite post-exploitation tools but rather as really minimalistic thing with all of the basic features in less than 5000 lines of code, client DLL size is less than 20Kb without compression.
		* [Laika](https://github.com/CPunch/Laika)
		* [EternalHush](https://github.com/APT64/EternalHushFramework)
		* [remote_hacker_probe](https://github.com/quantumcore/remote_hacker_probe)
	- C++
		* [Bitrat](https://github.com/Snykes/BitRat-Source-Code)
		* [serpentine](https://github.com/jafarlihi/serpentine)
	- C#
		* [Alan Framework](https://github.com/enkomio/AlanFramework)
		* [HardHatC2](https://github.com/DragoQCC/HardHatC2)
			* HardHat is a multi-user C# .NET-based command and control (C2) framework designed to aid in red team engagements and penetration testing. It aims to improve quality-of-life during engagements by providing a robust, easy-to-use C2 framework.
		* [Callidus](https://github.com/3xpl01tc0d3r/Callidus)
		* [MeowthCore](https://github.com/latortuga71/MeowthCore)
		* [AtlasC2](https://github.com/Gr1mmie/AtlasC2)
			* https://grimmie.net/atlasc2-carrying-the-weight-of-net-assemblies/
	- Go
		* [Monarch](https://github.com/pygrum/monarch)
			* Monarch is a C2 Framework designed to give implant developers the convenience of integrating with an existing backend, so that more time can be spent creating cutting-edge features and enhancing overall efficiency. By seamlessly integrating with an established backend, Monarch enables developers to dedicate their efforts to refining and expanding the capabilities of their implants, ensuring a swift and efficient development process.
		* [KittyStager](https://github.com/Enelg52/KittyStager)
			* KittyStager is a simple stage 0 C2. It is made of a web server to host the shellcode and an implant, called kitten. The purpose of this project is to be able to have a web server and some kitten and be able to use the with any shellcode.
		* [MeetC2](https://github.com/iammaguire/MeetC2)
		* [Crocodile](https://github.com/labulakalia/crocodile)
		* [Slackor](https://github.com/n00py/Slackor)
		* [Reinschauer](https://github.com/ps1337/reinschauer)
		* [MeetC2](https://github.com/iammaguire/MeetC2)
			* Modular C2 framework aiming to ease post exploitation for red teamers.
		* [toxcore](https://github.com/0x4meliorate/toxnet
			* Decentralised P2P botnet using toxcore.
		* [OrcaC2](https://github.com/Ptkatz/OrcaC2)
	- Java
	- JavaScript
		* [ShadowWorkers](https://github.com/shadow-workers/shadow-workers)
			* Shadow Workers is a free and open source C2 and proxy designed for penetration testers to help in the exploitation of XSS and malicious Service Workers (SW)
		* [JYang](https://github.com/waldo-irc/JYang)
		* [Striker](https://github.com/4g3nt47/Striker)
	- Pascal
		* [Asena](https://github.com/x140y40/Asena)
			* Asena is a framework to create position independant shellcode. It can also used as a on-the-fly self upgrading software or build customized stubs with func-in-technology.
	- PowerShell
		* [Amnesiac](https://github.com/Leo4j/Amnesiac)
			* Amnesiac is a post-exploitation framework designed to assist with lateral movement within active directory environments.
		* [HTTP-Shell](https://github.com/JoelGMSec/HTTP-Shell)
			* HTTP-Shell is Multiplatform Reverse Shell. This tool helps you to obtain a shell-like interface on a reverse connection over HTTP. Unlike other reverse shells, the main goal of the tool is to use it in conjunction with Microsoft Dev Tunnels, in order to get a connection as close as possible to a legitimate one.
		* [Meterpreter](https://github.com/r00t-3xp10it/meterpeter)
			* C2 Powershell Command & Control Framework with BuiltIn Commands 
	- Python
		* [most-average-c2-ever](https://github.com/nickvangilder/most-average-c2-ever)
		* [GIVINGSTORM](https://github.com/LiveGray/GIVINGSTORM0
		* [Badrat C2](https://gitlab.com/KevinJClark/badrats/-/tree/master)
			* Python server, JScript, HTA, Powershell, and C# implants. HTTP(S) and SMB comms. Not a good C2.
		* [sshimpanzee](https://github.com/lexfo/sshimpanzee)
			* SSHD Based implant supporting tunneling mecanisms to reach the C2 (DNS, ICMP, HTTP Encapsulation, HTTP/Socks Proxies, UDP...)
		* [mesa](https://github.com/d3adzo/mesa)
			* In-progress C2 utlizing NTP as transport protocol.
		* [GodGenesis](https://github.com/SaumyajeetDas/GodGenesis)
			* A Python3 based C2 server to make life of red teamer a bit easier. The payload is capable to bypass all the known antiviruses and endpoints.
		* [Zuthaka](https://github.com/pucarasec/zuthaka)
			* Zuthaka is an open source application designed to assist red-teaming efforts, by simplifying the task of managing different APTs and other post-exploitation tools.
		* [PickleC2](https://github.com/xRET2pwn/PickleC2)
			* PickleC2 is a post-exploitation and lateral movements framework 
		* [mal00](https://github.com/magnusstubman/mal00)
		* [Kratosknife](https://github.com/PushpenderIndia/KratosKnife)
		* [The-Soaring-Eagle](https://github.com/ItsCyberAli/The-Soaring-Eagle)
			* A CLI C2 developed for people who want to learn more about C2 development and malware development to better understand their red team operations.
		* [DarkFinger-C2](https://github.com/hyp3rlinx/DarkFinger-C2/)
			* Windows TCPIP Finger Command / C2 Channel and Bypassing Security Software
		* [Villain](https://github.com/t3l3machus/Villain)
		* [PoshC2](https://poshc2.readthedocs.io/en/latest/)
		* [Palinka](https://github.com/lapolis/palinka_c2)
		* [phpsploit](https://github.com/nil0x42/phpsploit)
	- Rust
		* [OffensiveNotion](https://github.com/mttaggart/OffensiveNotion)
		* [Heroinn](https://github.com/b23r0/Heroinn)
			* A cross platform C2/post-exploitation framework.
		* [link](https://github.com/postrequest/link)
			* link is a command and control framework written in rust
	Articles
		* [Lessons In C2 From The CIA](https://web.archive.org/web/20220706214914/https://cr.culbertreport.com/2021/11/lessons-in-c2-from-cia.html)
		* [Using metasploit to stage your own payloads - fx2301)](https://dev.to/fx2301/using-metasploit-to-stage-your-own-payloads-52d5)
		* [Building a Basic C2 - 0xRick](https://0xrick.github.io/misc/c2/)
		* [Stageless HTTP in Covenant - s3cur3th1ssh1t(2022)](https://s3cur3th1ssh1t.github.io/Covenant_Stageless_HTTP/)
	Comms
		* [Calling Home, Get Your Callbacks Through RBI - Lance B. Cain(2024)](https://posts.specterops.io/calling-home-get-y)
		* [secret_handshake](https://github.com/jconwell/secret_handshake)
			* A prototype malware C2 channel using x509 certificates over mTLS
		* [Adjacency List to Manage P2P Implants - RastaMouse(2022)](https://rastamouse.me/adjacency-list-to-manage-p2p-implants/)
		DNS
			* [DNSKeyGen](https://github.com/mhaskar/DNSKeyGen)
				* A tool to exchange decryption keys for command and control (C2) beacons and implants through DNS records.
			Netbus, BackOrifice, Sub7
			DNS Tunneling - bugtraq 1998
			iWorm botnet 2014
			Black Hat Python github 2015
			Hammertoss APT29 2015
			Trojan Turla 2017
		TLS
			* [FakeTLS](https://github.com/raykaryshyn/FakeTLS)
				* Client/server code that impersonates TLS 1.3 to disguise C2 activity.
	Talks
		* [Develop Your Own RAT: EDR + AV Defense by Dobin Rutishauser(DefconSwitzerland2022)](https://www.youtube.com/watch?v=w0bh7s7bVXI)
		* [Designing a C2 Framework - Daniel Duggan(DEFCON29 Adversary Village)](https://www.youtube.com/watch?v=oasBguDw_Ho)
		* [Command, Control, and memes: Cordyceps + ant = zombie - pr0b3r7(CC12)](https://www.youtube.com/watch?v=bQfy-quoAh8)
			* "This talk intends to raise awareness on the functioning of what comprises a C2 deployment a Red Team can use during offensive cyber operations, how are its components deployed, configured, and secured as well as how this can all be performed in an automated manner. We’ll cover how an enterprise grade Red Team leverages Infrastructure as code with the goal of improving the security posture of the organization by spending less time doing ‘Sysadmin’ tasks and more time attacking!"
	Reverse Shells
		* [icmpsh](https://github.com/bdamele/icmpsh)
			* Simple reverse ICMP shell 
	Covenant
		* [Forerunner](https://github.com/checkymander/Forerunner)
			* Automation Engine using the Covenant API and lua scripting
		* [C2Bridge](https://github.com/cobbr/C2Bridge)
			* Bridges allow developers to create new custom communication protocols and quickly utilize them within Covenant.
	DNSCat2
		* [dnscat(how)2 - Quick primer on how to setup and use dnscat2](https://blog.notso.pro/2022-05-14-dnscat2-howto/)
	Havoc
		General
			* [Havoc-Store](https://github.com/p4p1/havoc-store)
		Agents
			* [Pyhmmm](https://github.com/CodeXTF2/PyHmmm)
				* Simple PoC Python agent to showcase Havoc C2's custom agent interface. Not operationally safe or stable. Released with accompanying blog post as a tutorial sample 
			* [Revenant](https://github.com/0xTriboulet/Revenant)
				* A 3rd party agent for Havoc that demonstrates evasion techniques in the context of a C2 framework
			* [SharpAgent](https://github.com/susMdT/SharpAgent)
				* A .NET Framework test agent for Havoc C2. I just wanna learn how to make c2 implants. Will receive updates for now.
			* [Shaco](https://github.com/souzomain/Shaco)
				* Shaco is a minimal C linux agent for https://github.com/HavocFramework/Havoc. Shaco communicate with http to the server using hardcoded socket
		Plugins
			* [havoc-bloodhound](https://github.com/p4p1/havoc-bloodhound)
				* A GUI wrapper inside of Havoc to interact with bloodhound CE
			* [LatLoader](https://github.com/icyguider/LatLoader)
				* PoC module to demonstrate automated lateral movement with the Havoc C2 framework.
			* [havoc_profile_generator](https://github.com/Ghost53574/havoc_profile_generator)
				* Havoc C2 profile generator is a python3 script that generates profiles to be used with the Havoc C2 Framework.
			* [Havoc Profile Generator by 0xv1n](https://github.com/0xv1n/Havoc-ProfileGenerator)
				* Simple GUI tool to generate a Havoc C2 profile for Demon.
		ExternalC2
			* [HavocNotion](https://github.com/CodeXTF2/HavocNotion)
				* A simple ExternalC2 POC for Havoc C2. Communicates over Notion using a custom python agent, handler and extc2 channel. Not operationally safe or stable, built as a PoC to showcase Havoc C2's modular C2 channel interface.
		Writeups
			* [Home Grown Red Team: From Workstation To Domain Controller With Havoc C2 and Microsoft EDR - assumebreach(2022)](https://assume-breach.medium.com/home-grown-red-team-from-workstation-to-domain-controller-with-havoc-c2-and-microsoft-edr-6b17018e32f6)
			* [HavocExploit](https://github.com/syncwithali/HavocExploit)
				* A remote unauthenticated DOS POC exploit that targets the authentication implementation of Havoc.
	Metasploit
		- Articles
			* [Understanding a Payload's Life - ATTL4S](https://attl4s.github.io/assets/pdf/Understanding_a_Payloads_Life.pdf)
			* [Attack automation with Metasploit tasks - Dawid Golak(2020)](https://medium.com/@dawid.golak/attack-automation-with-metasploit-tasks-c389a4c2e3a6)
			* [Updating Mimikatz in Metasploit - Istvan Toth(2021)](https://infosecwriteups.com/updating-mimikatz-in-metasploit-1ce505e811e1?gi=6e7131df0f9b)
			* [Meterpreter vs Modern EDR(s)](https://redops.at/en/blog/meterpreter-vs-modern-edrs-in-2023)
				* "However, in this blog post I would like to show that even today (March 2023) very simple modifications to a Meterpreter shellcode dropper can be sufficient to bypass modern EDRs. To do this, we will step through three modifications to a Meterpreter reference dropper and record the results in the context of EDR evasion. The three modifications include simply encrypting the Meterpreter shellcode with the XOR algorithm, adding legitimate metadata using a manifest file, and moving the Meterpreter shellcode from the .text section to the .data section."
		- Documentation
			* [reverse_tcp(Windows) - meterpreter documentation](https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/payload/windows/meterpreter/reverse_tcp.md)
			* [reverse_https(Windows) - meterpreter documentation](https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/payload/windows/meterpreter/reverse_https.md)
			* [reverse_tcp(Linux) - meterpreter documentation](https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/payload/linux/x86/meterpreter/reverse_tcp.md)
			* [reverse_tcp(Python) - meterpreter documentation](https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/payload/python/meterpreter/reverse_tcp.md)
		- Extensions
			* [freeMetsrvLoader](https://github.com/attl4s/freeMetsrvLoader)
				*  freeBokuLoader fork which targets and frees Metsrv's initial reflective DLL package
		- Implants
			* [CelestialSpark](https://github.com/Karkas66/CelestialSpark)
				* A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders Stardust 
	Mythic
		* [Thanatos](https://github.com/MythicAgents/thanatos)
		* [Nimpostor](https://github.com/sec-consult/Nimpostor)
			* Nimpostor is an implant written in Nim designed to work with MythicC2. It's mainly used for initial access and system enumeration.
		* [Spinning Webs — Unveiling Arachne for Web Shell C2 - Cody Thomas(2024)](https://posts.specterops.io/spinning-webs-unveiling-arachne-for-web-shell-c2-26c40f570ea1)
		* [Introduction to Mythic C2 - Justin Palk(2023)](https://redsiege.com/blog/2023/06/introduction-to-mythic-c2/)
		* [Freyja](https://github.com/antman1p/freyja)
		* [Orthrus](https://github.com/MythicAgents/orthrus)
			* Orthrus is a macOS agent that uses Apple's MDM to backdoor a device using a malicious profile. It effectively runs its own MDM server and allows the operator to interface with it using Mythic.
		* [ Crossplatform operations with Athena - Scottie Austin(2022](https://blog.checkymander.com/red%20team/c2/Athena/)
	NightHawk
		* [Nighthawk 0.2.4 – Taking Out The Trash](https://www.mdsec.co.uk/2023/05/nighthawk-0-2-4-taking-out-the-trash/)
	OctoPwn
		* [octopwn-wasm-documentation](https://github.com/skelsec/octopwnweb)
			* Documentation for the OctoPwn WASM framework
		* [OctoPwn Embedded device information](https://github.com/octopwn/embedded)
	Sliver
		* [Writing a Beginner's Guide to Sliver Because the Devs Won't -  @An00bRektn(2022)](https://notateamserver.xyz/sliver-101/)
		* [Customizing Sliver – Part 1 - Alessandro Iandoli(2023)](https://security.humanativaspa.it/customizing-sliver-part-1/)
	TrevorC2
		* [Discord Hangouts: Dave Kennedy's Birthday Bash(2020)](https://www.youtube.com/watch?v=c9eEanfsXYQ)



Cobalt Strike
	https://github.com/alphaSeclab/cobalt-strike
	https://www.cobaltstrike.com/blog/cobalt-strike-and-yara-can-i-have-your-signature/
	https://mp.weixin.qq.com/s/fhcTTWV4Ddz4h9KxHVRcnw
	https://github.com/Octoberfest7/Cohab_Processes
	https://improsec.com/tech-blog/staging-cobalt-strike-with-mtls-using-caddy
	https://github.com/sussurro/BetterTorch
	https://github.com/FortyNorthSecurity/RandomScripts
	https://github.com/th3k3ymak3r/minbeacon
	https://github.com/CodeXTF2/cobaltstrike-headless
	https://github.com/Octoberfest7/MemFiles
	https://blog.yaxser.io/blue/detecting-cobalt-strike-fork-and-run?utm_source=substack&utm_medium=email
	https://rastamouse.me/ntlm-relaying-via-cobalt-strike/
	https://www.whiteoaksecurity.com/blog/cobalt-strike-opsec/
	https://github.com/Octoberfest7/Inline-Execute-PE
	https://github.com/Cerbersec/KillDefenderBOF
	https://github.com/RedefiningReality/Cobalt-Strike
	https://sokarepo.github.io/redteam/2023/10/11/create-reflective-dll-for-cobaltstrike.html
	https://github.com/SecIdiot/FOLIAGE
	https://github.com/NVISOsecurity/CobaltWhispers
	https://github.com/EspressoCake/BeaconDownloadSync
	https://github.com/RomanRII/jenkins-strike
	https://github.com/yqcs/CSPOC
	https://github.com/Henkru/cs-token-vault
	https://github.com/WKL-Sec/HiddenDesktop?utm_source=substack&utm_medium=email
	https://github.com/crypt0p3g/bof-collection
	https://github.com/ORCA666/EVA3
	https://twitter.com/snovvcrash/status/1503381035047862287
	https://github.com/ShadowMccc/MemoryEvasion
	https://github.com/OtterHacker/CoffLoader
	https://securityintelligence.com/posts/defining-cobalt-strike-reflective-loader/
	https://github.com/kyleavery/Aceldr
	https://github.com/realoriginal/titanldr-ng
	https://github.com/hakaioffsec/coffee
	https://github.com/Cracked5pider/KaynStrike
	https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-059a
	https://github.com/xforcered/BokuLoader
	https://github.com/S4ntiagoP/freeBokuLoader
	https://github.com/WBGlIl/ReBeacon_Src
	https://passthehashbrowns.github.io/implementing-smart-inject
	https://github.com/rookuu/BOFs
	https://github.com/oXis/GPUSleep
	https://github.com/Cerbersec/DomainBorrowingC2
	https://blog.xenoscr.net/2022/03/12/Implementing-Syscalls-in-Cobalt-Strike-Part-1-Battling-Imports-and-Dependencies.html
	https://github.com/EBalloon/Rw-No-Attach
	https://www.cobaltstrike.com/blog/revisiting-the-udrl-part-2-obfuscation-masking
	https://github.com/SecIdiot/titan
	https://github.com/Peithon/JustC2file
	101
		https://www.cobaltstrike.com/blog/
	Aggressor
		https://gist.github.com/Flangvik/5fb58dffa373a50f4d560a14adaa415b
		https://github.com/Octoberfest7/Cohab_Processes	
		https://github.com/passthehashbrowns/passthehashbrowns.github.io/blob/master/_posts/2022-06-16-Cobalt-Strike-Aliases-Kinda.md
		https://github.com/CodeXTF2/CobaltStrikeSoundBoard
		https://github.com/outflanknl/Recon-AD
			https://outflank.nl/blog/2019/10/20/red-team-tactics-active-directory-recon-using-adsi-and-reflective-dlls/
	Beacon
		https://github.com/mai1zhi2/SharpBeacon
		https://blog.redxorblue.com/2021/06/introducing-striker-and-payload.html
		https://github.com/dodo-sec/Malware-Analysis/blob/main/Cobalt%20Strike/Indirect%20Syscalls.md
		https://github.com/emcghee/PayloadAutomation
		https://github.com/N7WEra/BofAllTheThings
		https://github.com/bestspear/ReBeacon_ForClang
		http://blog.redxorblue.com/2022/06/automating-cobalt-strike-with-python.html
		* [BeaconHunter](https://github.com/3lp4tr0n/BeaconHunter)
			* "Behavior based monitoring and hunting tool built in C# tool leveraging ETW tracing. Blue teamers can use this tool to detect and respond to potential Cobalt Strike beacons. Red teamers can use this tool to research ETW bypasses and discover new processes that behave like beacons."
	External C2
		https://github.com/Flangvik/CobaltBus
	Kits
		https://github.com/josephkingstone/cobalt_strike_extension_kit
		https://www.cobaltstrike.com/help-artifact-kit
			https://www.youtube.com/watch?v=mZyMs2PP38w
		https://github.com/josephkingstone/cobalt_strike_extension_kit/tree/2.0
		https://github.com/josephkingstone/cobalt_strike_extension_kit
		https://github.com/kyleavery/TitanLdr
		https://blog.cobaltstrike.com/2021/08/06/introducing-cobalt-strike-community-kit/
		https://br-sn.github.io/Implementing-Syscalls-In-The-CobaltStrike-Artifact-Kit/
	Malleable
		https://github.com/rsmudge/Malleable-C2-Profiles/blob/master/normal/reference.profile
	UDRL
		- Articles
			* [Cobalt Strike - User Defined Reflective Loader Studies - mav3rick33(2023)](https://mav3rick33.gitbook.io/the-lab/offensive-development/cobalt-strike-user-defined-reflective-loader-studies)
		- Tools
			* [MemoryEvasion](https://github.com/ShadowMccc/MemoryEvasion)
			* [ZenLdr](https://github.com/Mav3rick33/ZenLdr)
				* Basic implementation of Cobalt Strikes - User Defined Reflective Loader feature
	Profiles
		https://whiteknightlabs.com/2023/05/23/unleashing-the-unseen-harnessing-the-power-of-cobalt-strike-profiles-for-edr-evasion/
	BoF
		https://www.trustedsec.com/blog/bofs-for-script-kiddies/
		https://github.com/antroguy/LocklessBof
		https://github.com/REDMED-X/OperatorsKit
		https://github.com/BOFs/BOFs
		https://github.com/WKL-Sec/Winsocky
		https://github.com/mertdas/PrivKit
		https://github.com/realoriginal/doublepulsar
		https://github.com/netero1010/Quser-BOF
		https://github.com/Workingdaturah/BOF-Learning
		https://github.com/securifybv/BOFRyptor
		https://github.com/Mr-Un1k0d3r/Cookie-Graber-BOF
		https://github.com/EspressoCake/BOF_Development_Docker?utm_source=substack&utm_medium=email
		https://www.trustedsec.com/blog/using-rpc-in-bofs/
		https://blog.z-labs.eu/2024/02/08/bof-launcher.html
		https://securityintelligence.com/posts/how-to-hide-beacon-during-bof-execution/
			https://github.com/xforcered/BOFMask
		https://github.com/Hagrid29/BOF-SprayAD
		https://github.com/RalfHacker/Kerbeus-BOF
		https://github.com/Octoberfest7/DropSpawn_BOF
		https://github.com/yanghaoi/BOF_whoami/blob/master/whoami.c
		https://www.trustedsec.com/blog/changes-in-the-beacon-object-file-landscape/
		https://www.naksyn.com/injection/2022/02/16/running-cobalt-strike-bofs-from-python.html?s=09
		https://github.com/outflanknl/C2-Tool-Collection
		https://github.com/N7WEra/BofAllTheThings
		https://www.trustedsec.com/blog/situational-awareness-bofs-for-script-kiddies/
		https://github.com/connormcgarr/cThreadHijack
		https://github.com/Cobalt-Strike/bof_template
		https://www.trustedsec.com/blog/changes-in-the-beacon-object-file-landscape/
		https://github.com/MrAle98/BOF-herpaderping
		https://github.com/ScriptIdiot/BOF-patchit
		https://github.com/anthemtotheego/InlineExecute-Assembly
		https://github.com/Octoberfest7/JumpSession_BOF
		https://github.com/tijme/amd-ryzen-master-driver-v17-exploit
		https://github.com/dtmsecurity/bof_helper
		https://github.com/Octoberfest7/Mutants_Sessions_Self-Deletion
		https://github.com/slemire/bof-adopt
		https://github.com/JamesCooteUK/BOFs
		https://github.com/cube0x0/SyscallPack
		https://github.com/boku7/whereami
		https://github.com/0x3rhy/DumpThatLSASS-Bof
		https://github.com/CodeXTF2/WindowSpy
		https://github.com/connormcgarr/cThreadHijack
		https://github.com/sliverarmory/injectEtwBypass
		https://github.com/mlcsec/ASRenum-BOF
		https://github.com/REDMED-X/OperatorsKit
		https://github.com/jsecu/BOF-pack-1
		https://github.com/CodeXTF2/ScreenshotBOF
		https://github.com/wavvs/nanorobeus
		https://github.com/alfarom256/BOF-ForeignLsass
		https://github.com/netero1010/ServiceMove-BOF
		https://github.com/ScriptIdiot/BOF-patchit
		https://www.kitploit.com/2022/11/rdphijack-bof-cobalt-strike-beacon.html
		https://github.com/EspressoCake/DLL_Imports_BOF
		https://github.com/EspressoCake/DLL_Version_Enumeration_BOF
		https://github.com/guervild/BOFs/tree/dev/CredPrompt
		https://github.com/ScriptIdiot/BOF-patchit
		https://github.com/Octoberfest7/JumpSession_BOF
		https://gist.github.com/passthehashbrowns/a6f46856219ef353be2e49bf323f173d
		https://github.com/xforcered/Detect-Hooks
		https://github.com/crypt0p3g/bof-collection
		https://github.com/wavvs/nanorobeus
		https://github.com/byt3bl33d3r/BOF-Zig
		https://github.com/Cracked5pider/CoffeeLdr
		https://github.com/sliverarmory/injectEtwBypass
		https://github.com/sliverarmory/injectAmsiBypass
		https://github.com/cube0x0/BofRoast
		https://www.trustedsec.com/blog/a-developers-introduction-to-beacon-object-files/
		https://rustrepo.com/repo/wumb0-rust_bof
		https://github.com/CUHKJason/BOF-klist
		https://github.com/netero1010/RDPHijack-BOF
		https://github.com/EncodeGroup/BOF-RegSave
		https://github.com/snovvcrash/BOFs
		https://github.com/trustedsec/CS-Remote-OPs-BOF
		https://github.com/Octoberfest7/KDStab
		https://outflank.nl/blog/2020/12/26/direct-syscalls-in-beacon-object-files/
		https://github.com/GeorgePatsias/AskCreds-CS	
		https://github.com/nick-frischkorn/SuspendEventLogBOF
		- 101
		- Collections
		- AD
		- Compression
		- Credentials
		- Discovery
			* [LdapSignCheck](https://github.com/cube0x0/LdapSignCheck)
				* Beacon Object File to scan a Domain Controller to see if LdapEnforceChannelBinding or LdapServerIntegrity has been modified to mitigate against relaying attacks.
		- Evasion
			https://github.com/Cerbersec/KillDefenderBOF
		- Execution
		- Hooking
		- Privileges
		- Processes
		- Registry
		- Web
		- Windows Tokens

Creating a Red Team



Dropbox (Physical)
	https://github.com/sean-t-smith/T-Mobster
	https://labs.nettitude.com/blog/creating-an-ir-nightmare-drop-box/
	https://blog.devgenius.io/building-a-budget-red-team-implant-90aa9acaece0?gi=97b2c7258630
	https://luemmelsec.github.io/One-Box-To-Rule-Them-All/
	https://labs.nettitude.com/blog/creating-an-ir-nightmare-drop-box/


Engagement
	https://medium.com/@TheKomodoconsulting/github-the-red-teamers-cheat-sheet-56e36a792cdb
	https://kf0k.github.io/blog/Posts/osint_into_da/
	https://www.post.lu/business/blog/articles/cybersecurite/technical-corner/exercice-red-team-chapitre-2
	https://assume-breach.medium.com/
	https://redteam.guide/docs/checklists/red-team-checklist/
	https://3xpl01tc0d3r.blogspot.com/2020/03/hacking-into-corporate-network-noob-1.html
		https://s3cur3th1ssh1t.github.io/The-most-common-on-premise-vulnerabilities-and-misconfigurations/
		https://github.com/0xCGonzalo/Golden-Guide-for-Pentesting
		https://medium.com/bugbountywriteup/how-a-badly-configured-db-allowed-us-to-own-an-entire-cloud-of-over-25k-hosts-part-1-2-8846beab691e
		https://expel.io/blog/well-that-escalated-quickly-how-a-red-team-went-from-domain-user-to-kernel-memory/
		https://medium.com/bugbountywriteup/how-a-badly-configured-db-allowed-us-to-own-an-entire-cloud-of-over-25k-hosts-part-2-2-5a63da194bc1
		https://medium.com/bugbountywriteup/how-i-hacked-into-a-telecom-network-part-1-getting-the-rce-167c2bb320e6
		https://www.blackarrow.net/hindering-threat-hunting-a-tale-of-evasion-in-a-restricted-environment/
	* [Hacking the Supply Chain - Shlomi Oberman, Moshe Kol, Ariel Schön(Defcon2020)](https://www.youtube.com/watch?v=wHsjf2mAHIM)
		* This is the story of how we found and exploited a series of critical vulnerabilities (later named Ripple20) affecting tens or hundreds of millions of IoT devices across all IoT sector conceivable - industrial controllers, power grids, medical, home, networking, transportation, enterprise, retail, defense, and a myriad of other types of IoT devices, manufactured and deployed by the largest American and international vendors in these fields. These vulnerabilities were found in a TCP/IP software library located at the very beginning of a complex supply chain and have lurked undetected for at least 10 years, likely much more. Over the past two decades this library has spread around the world by means of direct use as well as indirectly, through ""second hand"" use, rebranding, collaborations, acquisitions and repackaging, having been embedded and configurated in a range of different ways. Many of the vendors indirectly selling and using this library were not aware of their using it. Now that they know, the patch propagation dynamics are very complex and may not be possible in some cases. This library is a little known, but widely used, embedded library developed by Treck Inc.known for its high reliability, performance, and configurability. Its features make it suitable for real-time operating system usage and low-power devices. Despite being used by many large, security-aware vendors, these vulnerabilities lay dormant and undiscovered - while actors of all types could have discovered these vulnerabilities by finding one of several bugs in any of the components, exposing hundreds of others immediately. This would provide a field day of affected devices for the picking. In this presentation, we will discuss one of the vulnerabilities in technical depth, demonstrating an RCE exploit on a vulnerable device. We will explain how the vulnerabilities became so widespread, and what we still don’t know. We will speculate as to why these vulnerabilities survived for so long and show why some vendors are worse affected than others.
	* [Supply Chainsaw - Matt "scriptjunkie" Weeks(Derpcon2020)](https://www.youtube.com/watch?v=aEeXv5clL7c&list=PLCXnHhr5mRLzcvpFSj389dO7ro2spPLTe&index=8)
		* Supply chain attacks are a gold standard of exploitation. Malicious software coming through the same channels as legitimate software is not in your threat model since it is nearly impossible to defend against. But supply chain attacks are often assumed to be expensive, time-consuming, and personally risky; exclusively the domain of intelligence services or well-funded criminal groups. This talk will show how anyone can launch similar software supply chain attacks that are effective against a global audience, and do so in ways that are nearly impossible to trace. It will examine numerous popular software distribution methods and show how most of them have readily exploitable weaknesses. For the popular software repositories, this talk will demonstrate how easy it is to upload unverified malicious code, and how it will be executed on countless systems with just a single errant keystroke or no mistake at all. This presentation will show how comprehensive public information also enables us to identify and target individuals trusted by enormous user bases and automate credential theft and infection of widely trusted software from source to distribution to end-user. Finally, this talk will show the results when many of these actions were performed in the wild with proof-of-concept non-malicious packages created to test and validate these infection vectors.

External
	https://lots-project.com/
	https://www.varonis.com/blog/box-mfa-bypass-totp/
	https://github.com/fierceoj/ShonyDanza
	https://blog.bushidotoken.net/2022/03/one-way-or-another-initial-access.html
	https://github.com/klezVirus/CVE-2021-40444
	https://github.com/Ridter/owa_info
	https://www.youtube.com/watch?v=SmTW_cGbveM
	https://www.youtube.com/watch?v=SKlO6CCnRY0
	https://github.com/dafthack/MFASweep
	https://www.sprocketsecurity.com/blog/how-to-bypass-mfa-all-day
	https://github.com/SecurityRiskAdvisors/msspray
	Exchange
		https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/
		https://www.thezdi.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server
		https://devco.re/blog/2021/08/06/a-new-attack-surface-on-MS-exchange-part-2-ProxyOracle/
		https://github.com/hausec/ProxyLogon
		https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html?m=1
	Log4J
		https://github.com/YfryTchsGD/Log4jAttackSurface
		https://y4y.space/2021/12/10/log4j-analysis-more-jndi-injection/
		https://github.com/veracode-research/rogue-jndi
		https://github.com/huntresslabs/log4shell-tester
		https://github.com/fullhunt/log4j-scan
		https://github.com/Cybereason/Logout4Shell
		https://github.com/nkoneko/VictimApp
		https://github.com/pimps/JNDI-Exploit-Kit
	NTLM
		https://www.hackingarticles.in/abusing-microsoft-outlook-365-to-capture-ntlm/
	O365
		https://github.com/nyxgeek/o365recon
		https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
	Password Spraying
		https://whynotsecurity.com/blog/credmaster/
		https://github.com/knavesec/CredMaster
		https://whynotsecurity.com/blog/credmaster/
		https://0xash.io/Harnessing-the-power-of-LinkedIn-and-Talon-for-Password-Spraying/#


Fameworks


HW Implants
	https://dev.to/rosesecurity/building-a-budget-red-team-implant-3i27
	https://github.com/ventoy/Ventoy
	* [Evil Logitech - erm I ment USB cable - LuemmelSec(2021)](https://luemmelsec.github.io/Building-An-Evil-USB-Cable/)
	* []()


Infra
	https://github.com/ItsJustShepherd/BREACH
	https://0xdarkvortex.dev/c2-infra-on-azure/
	https://github.com/ezra-buckingham/terry-the-terraformer
	https://github.com/amalshaji/portr
	https://github.com/open-policy-agent/conftest
	https://github.com/WasmEdge/WasmEdge
	https://about.gitlab.com/blog/2023/11/28/how-gitlabs-red-team-automates-c2-testing/
	https://github.com/SecuraBV/RedWizard
	https://fortynorthsecurity.com/blog/obfuscating-c2-traffic-with-google-cloud-functions/
	https://xret2pwn.github.io//Myths-About-External-C2/
	https://www.blackhillsinfosec.com/webcast-modern-c2-and-data-exfiltration-w-kyle-avery/
		https://www.blackhillsinfosec.com/wp-content/uploads/2021/12/SLIDES_ModernC2andDataExfiltration.pdf
	https://github.com/antoniomika/sish
	https://github.com/blackhillsinfosec/skyhook
	https://dev.to/rosesecurity/creative-c2-obfuscation-cloudfronting-through-firewalls-and-hiding-in-plain-pcap-3dkg
	https://github.com/redherd-project/redherd-framework
	https://rastamouse.me/yarp-as-a-c2-redirector/
	https://github.com/yoda66/MAAS/tree/main
	https://github.com/Fudgedotdotdot/oceanbreeze
	https://github.com/flipt-io/reverst
	https://github.com/HiwinCN/HTran
	https://blog.malicious.group/automating-c2-infrastructure-with-terraform-nebula-caddy-and-cobalt-strike/
	https://workos.com/blog/building-webhooks-into-your-application-guidelines-and-best-practices
	https://github.com/redeye-framework/Redeye
	https://dev.to/rosesecurity/transforming-azure-static-web-applications-into-c2-redirectors-118m
	https://github.com/hackerschoice/gsocket
	https://thegreycorner.com/2023/08/30/aws-service-C2-forwarding.html
	https://github.com/redteaminfra/redteam-infra/tree/master/external
	https://github.com/0xZDH/redirect.rules
	https://www.securesystems.de/blog/building-a-red-team-infrastructure-in-2023/
	https://github.com/klionsec/RedTeamer
	https://digi.ninja/blog/cloudfront_example.php
	https://iq.thc.org/tunnel-via-cloudflare-to-any-tcp-service?utm_source=substack&utm_medium=email
	https://github.com/A0RX/Red-Blueteam-party
	https://antonio-cooler.gitbook.io/coolervoid-tavern/port-knocking-from-the-scratch
	https://github.com/netskopeoss/jarm_randomizer
	https://0xsp.com/offensive/red-ops-techniques/abuse-cloudflare-zerotrust-for-c2-channels/
	https://blog.malicious.group/automating-c2-infrastructure-with-terraform-nebula-caddy-and-cobalt-strike/
	https://blog.malicious.group/automating-c2-infrastructure-with-terraform-nebula-caddy-and-cobalt-strike/
	https://notes.huskyhacks.dev/blog/red-team-infrastructure-done-right
	Automation
		https://nickzero.co.uk/automating-a-red-team-lab/
		https://github.com/b3n-j4m1n/Red-Terroir
		https://http418infosec.com/offsecops-using-jenkins-for-red-team-tooling
	Certs
		https://fortynorthsecurity.com/blog/httpsc2doneright-and-working/
	Domain Borrowing
	Domain Fronting
		https://redblue42.code42.com/domain-fronting-with-azure-and-caldera/
		https://teamt5.org/en/posts/hiding-in-plain-sight-obscuring-c2s-by-abusing-cdn-services/?utm_source=twitter&amp;utm_medium=SNS
	Pivoting
		https://github.com/muink/Clash.Meta
		https://github.com/pufferffish/wireproxy
		https://addons.mozilla.org/it/firefox/addon/container-proxy/
		https://github.com/dariost/soks
		https://www.nicoco.fr/blog/2023/09/10/wireguard/
		https://github.com/noisysockets/noisysockets
		https://github.com/noisysockets/gateway
	Telemetry
		https://vincentyiu.com/red-team/attack-infrastructure/cobaltsplunk
		https://github.com/ztgrace/red_team_telemetry
		https://www.lares.com/blog/red-team-telemetry-empire-edition/
		https://redcanary.com/products/telemetry/
		https://www.microsoft.com/security/blog/2020/06/11/blue-teams-helping-red-teams-a-tale-of-a-process-crash-powershell-and-the-mitre-attck-evaluation/
		https://www.microsoft.com/security/blog/2020/05/06/gain-24x7-detection-response-coverage-microsoft-defender-atp/
		* [Red Mirror: Bringing Telemetry to Red Teaming - Zach Grace(Derbycon2018)](https://www.irongeek.com/i.php?page=videos/derbycon8/track-2-14-red-mirror-bringing-telemetry-to-red-teaming-zach-grace)
			* Providing impact and insights on a red team engagement is crucial to improving the security posture of the target organization. Too often red teams have to comb through log files, pcaps or other disjointed artifacts to tell the whole story making it difficult especially on long-term engagements. The Red Mirror project is the mirror to the blue team’s SIEM; it’s an ELK-based system that captures operator actions, network traffic including C2 and MITRE ATT&CK tactics. By capturing this extensive amount of data, red teams can now easily query, visualize, and report on their actions. The gathered data has the added benefit of enabling red teams to perform infrastructure and operational security monitoring.

Keying

Learning

Logging

Mainframes
		https://www.irongeek.com/i.php?page=videos/louisvilleinfosec2019/track-2-02-a-gentle-introduction-to-hacking-mainframes-dan-helton%22
		https://www.irongeek.com/i.php?page=videos/derbycon5/stable31-learning-mainframe-hacking-where-the-hell-did-all-my-free-time-go-chad-rikansrud
		https://www.irongeek.com/i.php?page=videos/derbycon4/t217-hacking-mainframes-vulnerabilities-in-applications-exposed-over-tn3270-dominic-white

Methodology
	https://www.youtube.com/watch?v=38AsJ3shfjM&t=228s
	https://www.youtube.com/watch?v=qAIFUpLvJgM
	https://github.com/JDArmy/RTASS
	https://frischkorn-nicholas.medium.com/red-teaming-macos-101-33b5a1834a2e

Metrics

Modeling
	https://apps.dtic.mil/dtic/tr/fulltext/u2/a516716.pdf
	https://ieeexplore.ieee.org/document/8885401
	Graph Models
	https://www.youtube.com/watch?v=VNb5jt3jNHE

Payload Dev
	Collection of
		https://github.com/BankSecurity/Red_Team
		https://dmcxblue.gitbook.io/red-team-notes-2-0/
		https://otterhacker.github.io/
		https://github.com/ChiChou/sploits
		https://github.com/cocomelonc?tab=repositories
		https://github.com/trustedsec/Windows-MS-LSAT-RPC-Example
		https://github.com/mez-0/pantry
		https://github.com/ryanmrestivo/red-team
		https://github.com/0xdea/tactical-exploitation
		https://github.com/tonghuaroot/Awesome-macOS-Red-Teaming
	Unsorted
		https://github.com/11philip22/MessageBoxShellcode/blob/master/ShellcodeA/ShellcodeA.c
		https://www.youtube.com/watch?v=nPmcFKSHyvg		
		https://www.youtube.com/watch?v=wY0cj3Ucqcw
		https://www.youtube.com/watch?v=TfG9lBYCOq8
		https://www.youtube.com/watch?v=KgBuaHbD7GA
		https://github.com/akhin/metamalloc
		https://kyleavery.com/posts/unmanaged-dotnet-patching/
		https://github.com/utds3lab/multiverse
		https://redsiege.com/blog/2024/03/jigsaw/
		https://xacone.github.io/BestEdrOfTheMarket.html
		https://redops.at/en/blog/syscalls-via-vectored-exception-handling
		https://www.youtube.com/watch?v=ll-ViQT9Oew&list=PLtb1FJdVWjUcY29T0VcjWp6StdhcSXyDL&index=10
		https://www.youtube.com/watch?v=4mYhffBsGeY
		https://github.com/dyu/ffi-overhead
		https://github.com/Krypteria/AtlasLdr
		https://gatari.dev/posts/identifying-malicious-bytes-in-malware/
		https://medium.com/@sam.rothlisberger/havoc-c2-with-av-edr-bypass-methods-in-2024-part-1-733d423fc67b
		https://github.com/nefarius/socksifier
		https://www.cobaltstrike.com/blog/introducing-the-mutator-kit-creating-object-file-monstrosities-with-sleep-mask-and-llvm
		https://github.com/kleiton0x00/Proxy-DLL-Loads
		https://redops.at/en/knowledge-base
		https://github.com/Maldev-Academy/RemoteTLSCallbackInjection
		https://www.elastic.co/security-labs/doubling-down-etw-callstacks
		https://github.com/khalladay/hooking-by-example
		https://lsecqt.github.io/Red-Teaming-Army/malware-development/leveraging-the-direct-pointer---a-stealthy-maneuver-in-evasion-tactics/
		https://github.com/florylsk/ExecIT
		https://assume-breach.medium.com/home-grown-red-team-taking-on-a-hardened-windows-system-f31796ad3fc2
		https://github.com/KirillOsenkov/MSBuildStructuredLog
		https://github.com/libarchive/libarchive
		https://rastamouse.me/safehandle-vs-intptr/
		https://steve-s.gitbook.io/0xtriboulet/just-malicious/from-c-with-inline-assembly-to-shellcode
		https://github.com/EgeBalci/sgn
		https://sh3llsp4wn.github.io/Shellcode-With-The-Default-Linux-Toolchain/
		https://www.youtube.com/watch?v=e1ipR3W4vBQ
		https://www.youtube.com/watch?app=desktop&v=ZS3Rdld_Ebo&feature=emb_logo
		collection
			https://github.com/ihebski/A-Red-Teamer-diaries
			https://github.com/alphaSeclab/all-my-collection-repos
			https://github.com/rad9800/misc
				https://github.com/rad9800/talks
			https://github.com/assume-breach/Home-Grown-Red-Team
			https://github.com/hfiref0x/Misc
			https://0xpat.github.io/
			https://xcellerator.github.io/categories/linux/
			https://0range-x.github.io/
		Presentations
			https://github.com/Professor-plum/Presentations
	Agnostic
		https://www.youtube.com/watch?v=StSLxFbVz0M
		https://github.com/spencertipping/shell-tutorial
		https://github.com/spencertipping/jit-tutorial
		https://ristbs.github.io/2023/02/08/your-pocket-guide-to-opsec-in-adversary-emulation.html
		- Opinions/Food for thought
			* [CUPID—for joyful coding - Dan North & Associates(2022)](https://dannorth.net/2022/02/10/cupid-for-joyful-coding/)
			* [Asynchronous Command And Control and Why You Care If You Do Cyber Policy - Dave Aitel(2020)](https://cybersecpolitics.blogspot.com/2020/05/asynchronous-command-and-control-and.html)
			* [Programming Notes for Professionals books - goalkicker.com](https://goalkicker.com/)
		- Collection
			0xpat
				https://0xpat.github.io/Malware_development_part_1/
				https://0xpat.github.io/Malware_development_part_2/
				https://0xpat.github.io/Malware_development_part_3/
				https://0xpat.github.io/Malware_development_part_4/
				https://0xpat.github.io/Malware_development_part_5/
				https://0xpat.github.io/Malware_development_part_6/
				https://0xpat.github.io/Malware_development_part_7/
				https://0xpat.github.io/Malware_development_part_8/
				https://0xpat.github.io/Malware_development_part_9/
			Maelstrom
				https://pre.empt.dev/posts/maelstrom-arch-episode-1/
				https://pre.empt.dev/posts/maelstrom-arch-episode-2/
		Agnostic 101
			101
				https://www.youtube.com/watch?v=LIMw4JZohNo
			Getting started
			Payload sizes
			Staged vs Stageless
			XOR
		Anti
			https://speakerdeck.com/fr0gger/x-ray-of-malware-evasion-techniques-analysis-dissection-cure
			https://www.researchgate.net/publication/273595944_A_Software_Watermarking_Based_on_PE_File_with_Tamper-proof_Function
		Anti-Dbg
			https://github.com/hfiref0x/WubbabooMark
			https://secret.club/2021/01/04/thread-stuff.html
		Anti-Forensics
			https://github.com/jesseduffield/horcrux
		Anti-RE
		Anti-Sandbox
		Anti-Unpacker
		Anti-VM
			https://github.com/y11en/VMAware
		Build-time Obfuscation
			https://www.youtube.com/watch?v=5yDzbFz2yWo
			* [Meson](https://mesonbuild.com/Overview.html)
				* [meson](https://github.com/mesonbuild/meson)
				* Meson is a build system that is designed to be as user-friendly as possible without sacrificing performance. The main tool for this is a custom language that the user uses to describe the structure of his build. The main design goals of this language has been simplicity, clarity and conciseness. Much inspiration was drawn from the Python programming language, which is considered very readable, even to people who have not programmed in Python before.
		Comms
			https://github.com/subins2000/p2pt
		Compression
		Crypters
		Crypto/Encoding/Hashing
		Data storage
			https://github.com/souzomain/Packer
			https://github.com/rqlite/rqlite
		Delivery
		Disco
		Distribution of Execution
			* [“VANILLA” malware: vanishing antiviruses by interleaving layers and layers of attacks - Marcus Botacin, Paulo Lício de Geus, André Grégio](https://link.springer.com/article/10.1007/s11416-019-00333-y)
			* [Split](https://github.com/Kudaes/Split)
				* Divide and Conquer is an algorithm that is commonly applied in programming to solve a complex problem by dividing it into many simpler sub-problems. We can apply this approach to offensive security with a different goal: confuse EDRs so they lose track of our activities, preventing them from raising any alert. This is something similar of what can be seen lately on almost any phishing campaing in the wild: long infection chains, running multiple files step by step (e.g. .url -> .one -> .js -> .bat -> .dll) instead of running directly the final payload. Each one of the files executed performs a simple task (download another file, make any change in the registry, move files between directories or change their names/extensions and so on) that is hard to tag as malicious by itself, preparing the environment for the final execution.
		Entropy
			* [entropy(tool)](https://github.com/merces/entropy)
				* '`entropy` is a simple command-line tool to calculate the entropy of files.'
			* [EntropyReducer](https://github.com/Maldev-Academy/EntropyReducer)
				* Reduce Entropy And Obfuscate Youre Payload With Serialized Linked Lists
			* [The more predictable you are, the less you get detected - hiding malicious shellcodes via Shannon encoding - kleiton0x7e(2022)](https://kleiton0x00.github.io/posts/The-more-predictable-you-are-the-less-you-are-able-to-get-detected/)
			* [EntropyFix](https://github.com/ORCx41/EntropyFix)
				* a tool to reduce the entropy of your payload, It works By adding null bytes, in an ordered sequence: every 10 bytes it adds 5 null bytes.
		Evasion Methods
			https://g3tsyst3m.github.io/edr%20bypass/Malware-EDR-Evasion-Techniques/
			* [PART 1: How I Met Your Beacon – Overview - Dominic Chell(2022)](https://www.mdsec.co.uk/2022/07/part-1-how-i-met-your-beacon-overview/)
				* [Part 2 - Cobalt Strike](https://www.mdsec.co.uk/2022/07/part-2-how-i-met-your-beacon-cobalt-strike/)
				* [Part 3 - Brute Ratel](https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/0
		FFI
			https://sourceware.org/libffi/
			https://github.com/RobinFassinaMoschiniForks/Machinegun
		GUI/TUI
			https://archive.org/details/buildinginteract0000olse/page/650/mode/2up
			https://www.cs.cmu.edu/~bam/uicourse/05631fall2021/schedule.html
			https://www.youtube.com/playlist?list=PL3856C8FlIWfr_tX8CMUhOJvl34ylClgb
			https://news.ycombinator.com/item?id=30746110
			* [Tricks to improve console programs usability - Hackliza](https://hackliza.gal/en/posts/console_usability/)
		Heap Memory checking
			https://antonio-cooler.gitbook.io/coolervoid-tavern/detecting-heap-memory-pitfalls
		IPC
			* [call gates as stable comunication channel for NT x86 and Linux x86_64 - David Reguera(2022)](https://github.com/therealdreg/dregate/blob/main/call_gates_as_stable_comunication_channel_for_NT_x86_and_Linux_x86_64.txt)
		Job Queues
			* [How to build a job queue with Rust and PostgreSQL - Sylvan Kerkour(2021)](https://kerkour.com/rust-job-queue-with-postgresql)
		Keylogging
			* [Keylogging Across The Operating Systems  - Dan Borges(GrimmCon0x6-2021)](https://www.youtube.com/watch?app=desktop&v=g4ll7XKDJ4o)
				* [Slides](https://github.com/ahhh/presentations/blob/master/Grimmcon0x06%20-%20Keyloggers%20Across%20Operating%20Systems.pdf)
		Licensing
			* [Licensecc](https://github.com/open-license-manager/licensecc)
		LLVM
			* [A Journey to understand LLVM IR - @un_devs(2021)](https://un-devs.github.io/low-level-exploration/journey-to-understanding-llvm-ir/)
			https://un-devs.github.io/low-level-exploration/spending-time-understanding-GOLLVM/#
			https://github.com/KpwnZ/sllvm-obfuscator
			https://github.com/gmh5225/awesome-llvm-security
		Loaders
			* [Binary Loaders](https://github.com/malisal/loaders)
				* This repo is about small, self-contained implementations of various binary formats loaders (Macho on OSX, ELF on Linux/`*BSD` and PE on Windows). The rationale for these libraries is the following: You wrote an exploit and achieved arbitrary code execution. Now what?
		Metamorphism/Polymorphism
			https://www.hindawi.com/journals/scn/2023/8227751/
			* [Writing a Self-Mutating x86_64 C Program - Shane Tully(2013)](https://shanetully.com/2013/12/writing-a-self-mutating-x86_64-c-program/)
			* [Simple Mutation Ideas (substitution) with REX Prefix - amonsec(2020)](https://amonsec.net/posts/2020/12/00000006/)
			* [Writing a Mutation Engine and breaking Aimware](https://back.engineering/13/04/2022/)
			https://amonsec.net/posts/2021/01/00000007/
		Meatsploit
			* [My making of a Metasploit Module - Aaron Ringo(NolaCon2019)](https://www.irongeek.com/i.php?page=videos/nolacon2019/nolacon-2019-c-11-my-making-of-a-metasploit-module-aaron-ringo)
				* Metasploit is one of the most well-known security products on the market. Not being a paid developer I had never used github for collaboration and had a lot to learn. I'll be discussing my motivation for making a module, the process, and pick up where some of the documentation left off.
		Network
			https://www.wireguard.com/embedding/
			* [ratnet](https://github.com/awgh/ratnet)
			* [NaiveProxy](https://github.com/klzgrad/naiveproxy)
				* NaïveProxy uses Chromium's network stack to camouflage traffic with strong censorship resistence and low detectablility. Reusing Chrome's stack also ensures best practices in performance and security.
			* [Venom](https://github.com/Idov31/Venom)
				* Venom is a C++ library that is meant to give an alternative way to communicate, instead of creating a socket that could be traced back to the process, it creates a new "hidden" (there is no window shown) detached edge process (edge was chosen because it is a browser that is installed on every Windows 10+ and won't raise suspicious) and stealing one of its sockets to perform the network operations.
			* [Jumping into SOCKS - Jacques Coertze(2023)](https://sensepost.com/blog/2023/jumping-into-socks/)
			* [The HTTP crash course nobody asked for - fasterthanlime(2022)](https://fasterthanli.me/articles/the-http-crash-course-nobody-asked-for)
			* [Chilkat](https://www.chilkatsoft.com/)
				* Chilkat is a cross-language, cross-platform API providing 90+ classes for many Internet protocols, formats, and algorithms.
			gRPC
				https://github.com/bufbuild/protoc-gen-validate
			QUIC
				* [NTLMquic - Adam Chester(2022)](https://blog.xpnsec.com/ntlmquic/)
		Obfuscation
			* [Home Grown Red Team: Let’s Make Some Malware In C: Part 1 - assume-breach(2022)](https://assume-breach.medium.com/home-grown-red-team-lets-make-some-malware-in-c-part-1-dc48fb360658)	
				* [Part 2](https://assume-breach.medium.com/home-grown-red-team-lets-make-some-malware-in-c-part-2-27a9a6def9b0)
				* [Part 3](https://assume-breach.medium.com/home-grown-red-team-lets-make-some-malware-in-c-part-3-223b7e81133e)
			https://github.com/Naville/Nitpicking-OpenSourceObfuscators
			https://github.com/alphaSeclab/obfuscation-stuff/blob/master/Readme_en.md
			https://recon.cx/media-archive/2022/Recon2022_7_The_Next_Generation_of_Virtualization-based_Obfuscators.mp4
			https://www.zscaler.com/blogs/security-research/technical-analysis-rhadamanthys-obfuscation-techniques
			https://cfp.recon.cx/2022/talk/7WJ3QL/
			https://link.springer.com/article/10.1007/s11416-019-00333-y
			https://github.com/rootm0s/Protectors
			https://github.com/arnaugamez/talks
			https://github.com/rose-compiler/rose
			https://github.com/tum-i4/obfuscation-benchmarks
			https://www.zscaler.com/blogs/security-research/technical-analysis-rhadamanthys-obfuscation-techniques
			https://github.com/muellerberndt/obfuscation-metrics
			* [Automatically extracting static antivirus signatures - plowsec(2022)](https://blog.scrt.ch/2022/04/05/automatically-extracting-static-antivirus-signatures/)
				* https://github.com/scrt/avdebugger
			101
				* [A brief introduction to Packing and Obfuscation - Gaurav yadav(2021)](https://medium.com/ax1al/packing-and-obfuscation-fe6b03bbc267)
			Binary Rewriting
				https://github.com/ropfuscator/ropfuscator
					https://github.com/ropfuscator/librop
				https://github.com/HexHive/retrowrite
					https://nebelwelt.net/publications/files/20Oakland.pdf
				https://web.archive.org/web/20210718151838/https://www.d00rt.eus/2020/04/ebfuscation-abusing-system-errors-for.html
				https://www.usenix.org/conference/usenixsecurity22/presentation/schloegel
					https://github.com/RUB-SysSec/loki
				* [Writing a Mutation Engine and breaking Aimware - x86mike(2022)](https://back.engineering/13/04/2022/)
				* [Retrowrite](https://github.com/HexHive/retrowrite)
					* [RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization - Sushant Dinesh, Nathan Burow, Dongyan Xu, Mathias Payer(2020)](https://nebelwelt.net/publications/files/20Oakland.pdf)
						* The ideal solution for binary security analysis would be a static rewriter that can intelligently add the required instrumentation as if it were inserted at compile time. Such instrumentation requires an analysis to statically disambiguate between references and scalars, a problem known to be undecidable in the general case. We show that recovering this information is possible in practice for the most common class of software and libraries: 64-bit, position independent code. Based on this observation, we develop RetroWrite, a binary-rewriting instrumentation to support American Fuzzy Lop (AFL) and Address Sanitizer (ASan), and show that it can achieve compiler-level performance while retaining precision. Binaries rewritten for coverage-guided fuzzing using RetroWrite are identical in performance to compiler-instrumented binaries and outperform the default QEMU-based instrumentation by 4.5x while triggering more bugs. Our implementation of binary-only Address Sanitizer is 3x faster than Valgrind’s memcheck, the state-of-the-art binary-only memory checker, and detects 80% more bugs in our evaluation.
					* Retrowrite is a static binary rewriter for x64 and aarch64. It works without heuristics, does not introduce overhead and uses the symbolization technique (also known as reassemblable assembly) to insert instrumentation to binaries without the need for source code.
			Data Masking
				* [Shellcode: Data Masking - modexp(2022)](https://modexp.wordpress.com/2022/07/31/shellcode-data-masking/)
				* [From the Front Lines | Hive Ransomware Deploys Novel IPfuscation Technique To Avoid Detection - James Haughorn(2022)](https://www.sentinelone.com/blog/hive-ransomware-deploys-novel-ipfuscation-technique/)
				* [HellShell](https://github.com/ORCx41/HellShell)
					* transform your payload into ipv4/ipv6/mac arrays
			Error-based
				* [Ebfuscation: Abusing system errors for binary obfuscation - Markel Picado Ortiz(2020)](https://web.archive.org/web/20210718151838/https://www.d00rt.eus/2020/04/ebfuscation-abusing-system-errors-for.html)
					* [Ebsfuscator](https://github.com/d00rt/ebfuscator)
			Gimple
				https://github.com/meme/hellscape
			LLVM
				https://github.com/61bcdefg/Hikari-LLVM15
				https://github.com/HikariObfuscator/Hikari
				https://www.praetorian.com/blog/extending-llvm-for-code-obfuscation-part-1/
				https://polarply.medium.com/build-your-first-llvm-obfuscator-80d16583392b
				https://github.com/MaxXor/obfuscator-llvm
				https://github.com/obfuscator-llvm/obfuscator/wiki
				https://github.com/gmh5225/awesome-llvm-security
				* [Pluto-Obfuscator](https://github.com/bluesadi/Pluto-Obfuscator)
					* Pluto-Obfuscator is an obfuscator based on LLVM 12.0.1 by 34r7h4mn and za233.
				* [1nsanity](https://github.com/svv232/1nsanity)
					* 1nsanity is a LLVM pass that obfuscates against symbolic execution. It includes mathematical obfuscation, bogus control flow injection, and tacks on additional complexity to switch cases and branch instructions. It also includes infinite loop traps along with the use of the Collatz Conjecture as an opaque predicate. Included are challenges solved with both Angr and Manticore along with solve times both before and after obfuscation. A variety of test cases were used ranging from basic ctf challenges to a simple unix shell.
			Polyglot files
				* [tweetable-polyglot-png](https://github.com/DavidBuchanan314/tweetable-polyglot-png)
					* Pack up to 3MB of data into a tweetable PNG polyglot file.
			Shellcode
				https://github.com/nettitude/ShellcodeMutator
					https://labs.nettitude.com/blog/shellcode-source-mutations/
			Strings
				https://steve-s.gitbook.io/0xtriboulet/ttps/ttps-badstrings
				* [String Obfuscation The Malware Way - dr4konia(2022)](https://dr4k0nia.github.io/posts/String-Obfuscation-The-Malware-Way/)
					* [MurkyStrings](https://github.com/dr4k0nia/MurkyStrings)
			VM-Based
				https://github.com/lmy375/awesome-vmp
				https://github.com/segnolin/Vobfus
				https://github.com/enkomio/sacara
				https://github.com/eaglx/VirtualMachineObfuscationPoC
			Papers
			Tools
		Packers
			https://www.youtube.com/watch?app=desktop&v=ESLEf66EzDk
			https://www.youtube.com/watch?v=Q2vazB6SYfg
			https://github.com/DavidBuchanan314/monomorph
			https://joshpitts.medium.com/hooking-control-flow-guard-cfg-for-fun-and-profit-31f951485545
			* [Inceptor: Bypass AV/EDR solutions combining well known technique - Alessandro Magnosi (@klezVirus 2021)](https://raw.githubusercontent.com/klezVirus/inceptor/main/slides/Inceptor%20-%20Bypass%20AV-EDR%20solutions%20combining%20well%20known%20techniques.pdf)
				* [Blogpost](https://klezvirus.github.io/RedTeaming/AV_Evasion/CodeExeNewDotNet/)
			* [monomorph](https://github.com/DavidBuchanan314/monomorph)
				* MD5-Monomorphic Shellcode Packer - all payloads have the same MD5 hash
			* [Anti-UPX Unpacking](https://unprotect.it/technique/anti-upx-unpacking/)
				* "Anti-UPX Unpacking is the technique to prevent malware from being unpacked by tools like UPX. UPX packed binary indicates that the section names starting with UPX followed by a number (UPX0 and UPX1) and the string “UPX!” at the end of the PE header. This UPX reference structure is located at the end of the PE header and the header includes checksums, packed and unpacked sizes, and compression details."			
		Patching
			https://github.com/sisong/HDiffPatch
			https://github.com/sisong/HPatchLite
		Physical
			https://www.unknowncheats.me/forum/anti-cheat-bypass/312732-physmeme-handle-device-physicalmemory-door-kernel-land-bypasses.html#post2315458
		Plugin Architectures
			* [FuckThatPacker](https://github.com/Unknow101/FuckThatPacker)
				* A simple python packer to easily bypass Windows Defender
			* [Key[word]s to the Kingdom: Simple modular agents - Alex Manners(2020)](https://feed.prelude.org/p/keywords-to-the-kingdom-simple-modular)
		Port Multiplexing
		Sample
			* [Yarn](https://github.com/WetDesertRock/Yarn)
				* A small embeddable VM with a custom instruction set and everything stored in a statically allocated memory space.
			* [Dragon: A Windows, non-binding, passive download / exec backdoor](http://www.shellntel.com/blog/2015/6/11/dragon-a-windows-non-binding-passive-downloadexec-backdoor)
		Server/API stuff
			gRPC/Protobufs
		Shellcode
			https://github.com/XaFF-XaFF/Shellcodev
			https://security.humanativaspa.it/new-and-old-shellcode-samples/
			https://phasetw0.com/malware/writing-optimized-windows-shellcode-in-c/
			https://www.kitploit.com/2022/02/shellcodetester-application-to-test.html?m=1
			* [emoji-shellcoding](https://github.com/RischardV/emoji-shellcoding)
				*  🤩 Emoji shellcoding tools for RISC-V (32-bit and 64-bit)
			* [Jargon](https://github.com/hardwaterhacker/jargon)
				* "This project takes raw shellcode and encodes it using a dictionary of words. The dictionary could be a dictionary of English words, the text of a Shakespearean tragedy, or it could be strings extracted from your favorite system DLL. The only requirement is that the dictionary contains at least 256 unique entries and all characters are valid for string literals in C/C++. tldr: Use this program to translate shellcode bytes into words for entropy analysis evasion."
			https://github.com/preemptdev/bluffy
			https://github.com/mai1zhi2/ShellCodeFramework
			https://github.com/kleiton0x00/Shelltropy
			https://fortynorthsecurity.com/blog/quick-shellcode-modification/
		Building a Stage1/2 Beacon Examples
			https://und3rf10w.github.io/posts/2022/01/08/shlyuz-1-influences.html
			https://und3rf10w.github.io/posts/2022/01/19/shlyuz-2-CommsAndCrypto.html
			https://github.com/shlyuz/comms_demo
			https://0xrick.github.io/misc/c2/#agents
			https://openbuildservice.org/help/
			https://shogunlab.gitbook.io/building-c2-implants-in-cpp-a-primer/chapter-3-basic-implant-and-tasking
			https://github.com/RixedLabs/Community-Papers/tree/master/Evading%20Malware%20Analysis%20Using%20Reverse%20Execution
		Staged vs Stageless
		Talks & Presentations
			https://www.youtube.com/watch?v=yfgfixMKFGI&list=PLv-PXy2JVviu32C4U6F8KHKcyL4s-i_Fo&index=9
		Testing
		Tutorials
		Updates
		Virtual Filesystems
		VM
			https://github.com/jephthai/EvilVM
				http://thestone.zone/hacking/2016/06/17/evilvm-1.html
				http://thestone.zone/hacking/2016/07/08/evilvm-3-instructions.html
				http://thestone.zone/hacking/2016/07/23/more-instructions.html
				http://thestone.zone/hacking/2016/07/31/assembler.html
			https://www.youtube.com/watch?v=8IAlBjY9nBk
				http://cd.textfiles.com/defcon14/DC-14-Presentations/DC-14-Brown/DC-14-Brown.pdf
	Lang Specific - qwerty
		ASM
			https://danusminimus.github.io/2020/03/04/The-Art-of-Malware.html
			GUI/TUI
				https://github.com/profdrac/kolor
			Obfuscation
				https://labs.nettitude.com/blog/shellcode-source-mutations/
					https://github.com/nettitude/ShellcodeMutator
				https://github.com/defuse/gas-obfuscation
		AutoIT
			https://github.com/Ixiko/AHK-libs-and-classes-collection
		C
			https://archive.md/o2nD5
			https://github.com/json-c/json-c
			https://5pider.net/blog/2024/01/27/modern-shellcode-implant-design/
			https://github.com/3gstudent/Homework-of-C-Language
			https://github.com/lwthiker/curl-impersonate
			https://github.com/camel-cdr/cauldron
			https://github.com/s7ephen/seacrane/wiki
			https://github.com/gdabah/distorm
			https://github.com/Reijaff/offensive_c
			https://github.com/Processus-Thief/UnhookingDLL
			https://github.com/tombkeeper/Shellcode_Template_in_C
			https://github.com/RobertDiep/sandbox-process-bof
			https://github.com/pducklin/minimalisti-C
			https://github.com/susMdT/fictional-invention
			https://github.com/domzigm/lcscript
			https://github.com/NUL0x4C/APCLdr
			https://github.com/nothings/stb
			https://github.com/H4K6/FilelessPELoader
			https://github.com/Octoberfest7/Mutants_Sessions_Self-Deletion
			https://github.com/Mr-Un1k0d3r/RedTeamCCode
			https://nullprogram.com/blog/2022/08/08
			https://github.com/serge1/COFFI
			https://steve-s.gitbook.io/0xtriboulet/making-malware/making-malware-0
			https://bank-security.medium.com/undetectable-c-c-reverse-shells-fab4c0ec4f15
			https://github.com/rswier/c4
			https://github.com/tailscale/libtailscale
			https://github.com/zserge/jsmn
			https://tigress.wtf/introduction.html
			https://github.com/Maldev-Academy/HellHall
			https://github.com/0vercl0k/udmp-parser
			https://github.com/VollRagm/PTView
			https://github.com/KANKOSHEV/Detect-HiddenThread-via-KPRCB
			https://redteamer.tips/help-i-need-to-write-code-in-c-part-1-setup-and-intro/
			https://redteamer.tips/help-i-need-to-write-code-in-c-part-2-portable-executable-and-nt-functions/
			https://redteamer.tips/help-i-need-to-write-code-in-c-part-3-peb-and-best-practices/
			https://github.com/ReversingID/Shellcode-Loader
			https://github.com/estimated1337/hidden_syscall
			https://github.com/TheD1rkMtr/AMSI_patch
			https://und3rf10w.github.io/posts/2022/08/21/shlyuz-3.html
			https://github.com/hudjefa/msvc-wine
			https://github.com/rswier/c4
			https://www.x86matthew.com/view_post?id=ntsockets
			https://github.com/trickster0/CReadMemory
			https://github.com/Originns/msvc-tailcalls
			https://web.archive.org/web/20201004035809/https://hiddencodes.wordpress.com/
			https://github.com/Ryze-T/EdrKiller
			https://0x00sec.org/t/dynamically-extracting-the-encryption-key-from-a-simple-ransomware/28379
			https://web.archive.org/web/20201104124239/https://hiddencodes.wordpress.com/category/cc/
			https://web.archive.org/web/20170823090909/https://hiddencodes.wordpress.com/2014/09/18/windows-process-name-hashes-list-1/
			https://github.com/Allevon412/TeamsImplant
			https://github.com/4g3nt47/Striker
			https://github.com/x64Reaper/EncryptMe
			https://github.com/rofirrim/gcc-tiny
			https://github.com/francisrstokes/tiny-c-projects/tree/main/stretchy-buffers
			https://github.com/latortuga71/CToShellcodeAutomation
			https://web.archive.org/web/20141108142610/http://hiddencodes.wordpress.com/category/windows/
			https://github.com/jungjin0003/FunctionCaller
			https://github.com/huntandhackett/concealed_code_execution
			https://github.com/NUL0x4C/AtomLdr
			https://github.com/lammertb/libhttp
			https://github.com/bitcoin-core/ctaes
			https://github.com/xalicex/Unhook-Import-Address-Table
			https://github.com/anthemtotheego/InlineExecute-Assembly
			https://github.com/smx-smx/ezinject
			https://gitlab.com/ORCA000/d.rdynamicshellcode/-/blob/main/Loader.c
			https://viewsourcecode.org/snaptoken/kilo/
			* [Undetectable C# & C++ Reverse Shells - Bank Security](https://medium.com/@Bank_Security/undetectable-c-c-reverse-shells-fab4c0ec4f15)
				* Technical overview of different ways to spawn a reverse shell on a victim machine
			https://github.com/xalicex/Unhook-Import-Address-Table
			https://github.com/hfiref0x/LightFTP
			http://knosof.co.uk/cbook/
			* [HellsGatePPID](https://github.com/boku7/HellsGatePPID)
			https://github.com/rofl0r/microsocks
			https://medium.com/@lsecqt/creating-fully-undetectable-payload-fud-with-c-46a734837d1c
			https://bruteratel.com/research/feature-update/2021/06/01/PE-Reflection-Long-Live-The-King/
			https://bruteratel.com/tabs/ratelwarroom_features/badgers/coffexec/
			https://github.com/nothings/stb
			https://github.com/ORCx41/ManualRsrcDataFetching
			https://github.com/Nomade040/nmd
			https://github.com/Arno0x/DivertTCPconn
			https://github.com/CoolerVoid/ninja_shell
			https://github.com/mactec0/Kernelmode-manual-mapping-through-IAT
			https://github.com/paullouisageneau/libplum
			Collections/Cheatsheets
				https://github.com/uhub/awesome-c
			Agnostic
				https://www.geeksforgeeks.org/bit-fields-c/
				https://github.com/tezc/sc
				https://stackoverflow.com/questions/5793098/go-bitfields-and-bit-packing/5794415#5794415
			Anti-Dbg
				https://github.com/ZeroMemoryEx/Orca
			ASM
			Build
				https://news.ycombinator.com/item?id=30488979
				https://conan.io/
				https://github.com/iiicp/lcc
				https://blogs.gentoo.org/mgorny/2021/02/19/the-modern-packagers-security-nightmare/
				https://0x00sec.org/t/multi-platform-execution/25663
				https://github.com/tpoechtrager/wclang
				https://github.com/malxau/minicrt
				https://ahgamut.github.io/2021/02/27/ape-cosmo/
				https://cgold.readthedocs.io/en/latest/
				https://cgold.readthedocs.io/en/latest/
				https://github.com/cpredef/predef
				https://github.com/LoopPerfect/buckaroo
				https://github.com/mmozeiko/build-gcc-mingw
				https://github.com/zyantific/zycore-c
				https://airbus-seclab.github.io/c-compiler-security/
				https://github.com/mrexodia/CMakePackageExample
				https://www.youtube.com/watch?v=TfG9lBYCOq8
					https://raw.githubusercontent.com/rad9800/talks/main/Writing%20Tiny%2C%20Efficient%2C%20And%20Reliable%20Malware.pdf
			C2Go
			C2Rust
			CLI Params
				https://www.gnu.org/software/libc/manual/html_node/Argp.html
			Collection
				https://github.com/jibsen/brieflz
			Comms
				https://github.com/warmcat/libwebsockets
			Compression
				https://github.com/libarchive/libarchive
			Credentials
				https://github.com/kartikdurg/Enum-LSASS
			Crypto
				XoR
					https://www.leeholmes.com/xor-is-not-as-fancy-as-malware-authors-think/
				Encryption
					https://github.com/mwarning/libsodium-example
					https://github.com/P1sec/gea-implementation
					https://github.com/kokke/tiny-ECDH-c
					https://github.com/devershichandra27/C-implementation-of-AES
					https://github.com/kokke/tiny-AES-c
				Hashing
					https://github.com/clibs/hash
					https://github.com/ryancdotorg/hashprogs
					https://github.com/jwerle/murmurhash.c
			Data Storage
			Debug
				https://github.com/eyalitki/Scout
			Disasm
				https://github.com/zyantific/zydis
				https://github.com/vmt/udis86
			Discovery
				https://github.com/outflanknl/Ps-Tools
			ELF Loader
			Embedded Interpreters/Scripting
				https://github.com/kyleavery/inject-assembly
			Encryption
			Evasion
				Env Keying
					https://github.com/Octoberfest7/BeatRev
				Memory
					https://github.com/Idov31/Cronos
					https://idov31.github.io/2022/11/06/cronos-sleep-obfuscation.html
			Execution
				https://github.com/Pithikos/C-Thread-Pool
			GUI/TUi
				https://github.com/frang75/nappgui_src
				https://github.com/tsoding/olive.c
			Injection
				https://github.com/kubo/injector
				https://github.com/can1357/ThePerfectInjector
			JSON
				https://zserge.com/jsmn/
				https://github.com/json-parser/json-parser
			Keying
				https://github.com/Octoberfest7/BeatRev
			Loader / Stage0or1
				https://github.com/capt-meelo/laZzzy
				https://github.com/boku7/BokuLoader
				https://github.com/TheD1rkMtr/Shellcode-Hide
				https://github.com/pwn1sher/RTImplant
				https://github.com/Mofisto/Syscall
				https://github.com/reveng007/ReflectiveNtdll
				https://github.com/Cerbersec/Ares
				https://github.com/rsmudge/metasploit-loader
				https://github.com/D1rkMtr/ObfLoader
				https://github.com/Yaxser/COFFLoader2
				https://github.com/killvxk/TitanLdr_for_memory
				https://github.com/jnastarot/native_peloader
				https://github.com/ZeroM3m0ry/Orca
				* [mettle](https://github.com/rapid7/mettle)
					* This is an implementation of a native-code Meterpreter, designed for portability, embeddability, and low resource utilization. It can run on the smallest embedded Linux targets to big iron, and targets Android, iOS, macOS, Linux, and Windows, but can be ported to almost any POSIX-compliant environment.
				* [KaynLdr](https://github.com/Cracked5pider/KaynLdr)
					* KaynLdr is a Reflective Loader written in C / ASM. It uses direct syscalls to allocate virtual memory as RW and changes it to RX. It erases the DOS and NT Headers to make it look less suspicious in memory.
			.NET
				https://github.com/chrisdunelm/DotNetAnywhere
			Network
				https://github.com/hmgle/graftcp
				https://github.com/earthquake/Socks5Server
				https://github.com/rofl0r/microsocks
				https://github.com/NTAP/quant
				https://github.com/yrutschle/sslh
				https://github.com/private-octopus/picoquic
				https://github.com/lwthiker/curl-impersonate
				https://github.com/lammertb/libhttp
				https://github.com/Mbed-TLS/mbedtls/
				https://github.com/0xcpu/winsmsd
				https://github.com/Theldus/wsServer
				https://github.com/microsoft/msquic
				https://github.com/Coldzer0/ReverseSock5Proxy
				https://github.com/emilarner/revsocks
				https://github.com/liudf0716/xfrpc
				https://github.com/alibaba/xquic
				https://github.com/heiher/hev-socks5-core
				https://github.com/Starwarsfan2099/C-Packet-Sniffer
				https://www.saminiir.com/lets-code-tcp-ip-stack-1-ethernet-arp/
					https://www.saminiir.com/lets-code-tcp-ip-stack-2-ipv4-icmpv4/
					https://www.saminiir.com/lets-code-tcp-ip-stack-3-tcp-handshake/
				https://github.com/iqiyi/libfiber
				https://gist.github.com/Cracked5pider/4f784ad7405eeda45a13a2b2638b85ec
			Obfuscation
				https://openpunk.com/pages/obfuscation-in-c/
				https://github.com/echtdefault/Janus
				https://github.com/fritzone/obfy
				https://gist.github.com/EvanMcBroom/ace2a9af19fb5e7b2451b1cd4c07bf96
			Packer
				https://github.com/ORCx41/AtomPePacker
			Parsers
			PEs
			PE Loader
				https://github.com/86hh/DreamLoader
				https://github.com/tishion/mmLoader
				https://github.com/D1rkMtr/FilelessRemotePE
				https://github.com/YagamiiLight/PE_Loader
				https://github.com/aplyc1a/PEMemoryLoader
				https://www.slideshare.net/44Con/44con-meterpreter-internalsv2
			PIC
				https://github.com/paranoidninja/PIC-Get-Privileges
				https://bruteratel.com/research/feature-update/2021/01/30/OBJEXEC/
			Polymorphism
			Processes (Windows)
			Re
			Samples
			Shellcode
				https://github.com/anthemtotheego/C_Shot
				https://github.com/thefLink/C-To-Shellcode-Examples
			Strings
				https://github.com/antirez/sds
			Syscalls
				Linux
				Windows
					https://github.com/janoglezcampos/c_syscalls
					https://github.com/ORCx41/Syscallslib
			Testing
				https://cunit.sourceforge.net/
			OS Specific
				Linux
				macOS
				Windows
			Web Server
				https://github.com/cesanta/mongoose
				https://github.com/aaronryank/win32-c-http
				https://github.com/civetweb/civetweb
				https://www.gnu.org/software/libmicrohttpd/
		CPP
			https://github.com/JustasMasiulis/process_handle
			https://open-license-manager.github.io/licensecc/
			https://github.com/mdsecactivebreach/ParallelSyscalls
			https://stackoverflow.com/questions/4102320/how-to-encrypt-strings-at-compile-time
			https://github.com/NVISOsecurity/DLLoader
			https://github.com/Jackarain/proxy
			https://github.com/waleedassar/ALPC_CLIENT_SERVER
			https://github.com/ChadMotivation/TymSpecial
			https://github.com/kleiton0x00/RemoteShellcodeExec
			https://kleiton0x00.github.io/
			https://github.com/lsecqt/OffensiveCpp
			https://github.com/NATsCodes/ProcessHollowing
			https://github.com/TheD1rkMtr/Shellcode-Hide
			https://github.com/S3cur3Th1sSh1t/Shellcode-Hide
			https://github.com/hlldz/RefleXXion
			https://github.com/foonathan/cppast
			https://github.com/0vercl0k/udmp-parser
			https://github.com/Processus-Thief/UnhookingDLL
			https://github.com/fortra/hw-call-stack
			https://github.com/Processus-Thief/PsNotifRoutineUnloader
			https://github.com/lammertb/libhttp
			https://github.com/TheD1rkMtr/D1rkLdr
			https://github.com/aaaddress1/PR0CESS
			https://github.com/qchateau/packio
			https://github.com/trhacknon/Shellcode-Loader
			https://github.com/filipdutescu/modern-cpp-template
			https://www.blackhat.com/docs/eu-14/materials/eu-14-Andrivet-C-plus-plus11-Metaprogramming-Applied-To-software-Obfuscation.pdf
			https://github.com/pocoproject/poco
			https://github.com/MScholtes/Suspend
			https://github.com/slyd0g/SK8RAT
			https://github.com/CodeXTF2/BusySleepBeacon
			https://github.com/helloobaby/heapwalk
			https://github.com/adrianyy/memorylib
			https://github.com/CLIUtils/CLI11
			https://github.com/charlesnicholson/nanoprintf
			https://github.com/rad9800/WTSRM
			https://github.com/chztbby/RebirthGuard
			https://github.com/shogunlab/Mochi
			https://github.com/BowenFu/matchit.cpp
			https://github.com/jnastarot/enma_pe
			https://github.com/jimmiebergmann/mini-yaml
			https://github.com/vincentlaucsb/csv-parser
			https://github.com/alfarom256/StinkyLoader
			https://github.com/Kharos102/NtdllUnpatcher
			https://github.com/frkngksl/Shoggoth
			https://github.com/fengjixuchui/COFFI
			https://github.com/AHXR/ahxrwinsocket
			https://github.com/veil-ivy/Utils
			https://github.com/BackupGGCode/portable-executable-library
			https://github.com/hikaru-i/jitasm
			https://github.com/d99kris/rapidcsv
			https://github.com/timwhitez/Doge-TypeUnhook
			0xPat
				https://0xpat.github.io/Malware_development_part_1/
				https://0xpat.github.io/Malware_development_part_2/
				https://0xpat.github.io/Malware_development_part_3/
				https://0xpat.github.io/Malware_development_part_4/
				https://0xpat.github.io/Malware_development_part_5/
				https://0xpat.github.io/Malware_development_part_6/
				https://0xpat.github.io/Malware_development_part_7/
				https://0xpat.github.io/Malware_development_part_8/
				https://0xpat.github.io/Malware_development_part_9/
			General
				https://github.com/AnthonyCalandra/modern-cpp-features
				https://github.com/mosra/corrade
			Anti-Dbg
				https://github.com/BaumFX/cpp-anti-debug
			ASM
			Build
				https://github.com/Akagi201/learning-cmake
				https://github.com/vlmillet/Phantom.JIT
				https://github.com/bitwizeshift/Lazy
				https://github.com/ned14/pcpp
				https://github.com/hsutter/cppfront
				https://github.com/sakra/cotire
			Cpp2Go
			Cpp2Rust
			CLI Params
				https://github.com/kongaskristjan/fire-hpp
			Crypto
				https://github.com/KN4CK3R/XorStr
				https://github.com/weidai11/cryptopp
				https://cocomelonc.github.io/malware/2023/03/09/malware-av-evasion-13.html
				https://github.com/rubendv/sodiumpp
				https://github.com/TyrarFox/encstr
				https://github.com/skadro-official/skCrypter
				https://github.com/qis/xorstr
			Data Storage
				https://github.com/SRombauts/SQLiteCpp
			Disasm
				https://github.com/addrianyy/asmlib
			Discovery
			ELF Loader
				https://github.com/serge1/ELFIO
			Embedded Interpreters/Scripting
			Encoding
				https://cocomelonc.github.io/malware/2022/07/30/malware-av-evasion-8.html
			Encryption
			Evasion
				CallStack
					https://github.com/Barracudach/CallStack-Spoofer
					https://github.com/countercept/CallStackSpoofer
				ETW
				PEB-related-things
					https://github.com/D1rkMtr/MasqueradingPEB
					https://github.com/Apxaey/Unlinking-Modules-From-The-PEB-Dll-Hiding-
			Execution
				https://github.com/RaymiiOrg/cpp-command-output
				https://github.com/rajatjain1997/subprocess			
			Dropers/Stage0/1 Loaders
			Execution
			Filesystem
				https://github.com/cpp-utility-codes/file_system/blob/master/c%2B%2Bio17/c%2B%2Bio17.cpp
				https://github.com/cpp-utility-codes/file_system
				https://github.com/ThomasMonkman/filewatch
				https://github.com/SpartanJ/efsw
			GUI/TUi
				https://github.com/daniele77/cli
				https://github.com/gammasoft71/xtd
				https://github.com/Patitotective/ImThemes
				https://github.com/ocornut/imgui
					https://github.com/ZehMatt/ImGuiApp
				https://github.com/HankiDesign/awesome-dear-imgui
				https://github.com/Code-Building/ImGuiBuilder
				https://github.com/gansm/finalcut
			Hooking
				https://github.com/TomOS3/UserModeUnhooking
				https://github.com/HadarShahar/process-hiders
				https://github.com/jungjin0003/ProcessStealth
			Injection
				https://github.com/Dos98/ProcessInjectionTechniques
				https://github.com/FULLSHADE/Jektor
				https://github.com/bopin2020/ProcessInjecting
				https://github.com/cepxeo/dll4shell
				https://github.com/SolomonSklash/SeasideBishop
				https://github.com/JustasMasiulis/remote_memory
				https://github.com/NtQuerySystemInformation/NlsCodeInjectionThroughRegistry	
				https://github.com/Ares-Developers/Syringe
				https://github.com/Snowming04/inject_shellcode_message_hook
				https://github.com/LordSquigles/Simple-Process-Hollowing-Example
				https://github.com/KooroshRZ/Windows-DLL-Injector
				https://github.com/JustasMasiulis/memory_signature
			IPC
				https://github.com/mutouyun/cpp-ipc
			JSON
				https://github.com/sheredom/json.h
				https://github.com/jonaskgandersson/jWriteCpp
				https://github.com/hjiang/jsonxx
				https://github.com/nlohmann/json
				https://github.com/kazuho/picojson
				https://github.com/sheredom/json.h
				https://github.com/open-source-parsers/jsoncpp
			Loader / Stage0or1
				https://github.com/elddy/Windows-NTAPI-Injector
				https://github.com/VirtualAlllocEx/Shellcode-Downloader-CreateThread-Execution
				https://github.com/slaeryan/AQUARMOURY/tree/master/Wraith
				https://github.com/BinaryScary/ReflectThis
				https://github.com/ambray/DotNetReflectiveLoading
				https://github.com/Processus-Thief/UnhookingDLL
				https://github.com/jonaslyk/temp/blob/main/dav.cpp
				https://github.com/memN0ps/ShellcodeRunners
				https://github.com/alfarom256/StinkyLoader
				https://github.com/kleiton0x00/RemoteShellcodeExec/
					https://infosecwriteups.com/shellcodes-are-dead-long-live-fileless-shellcodes-609cbacd5cb0?gi=a6713121eeb5
				https://github.com/Aekras1a/Updated-Carbanak-Source-with-Plugins
				https://github.com/xinbailu/DripLoader
				https://github.com/a7t0fwa7/D1rkLrd
				https://github.com/0xsp-SRD/0xsp.com/tree/main/Dynamic%20Assembly%20Loader
				https://github.com/Hagrid29/PELoader
				https://github.com/cocomelonc/peekaboo
				https://github.com/D1rkMtr/IORI_Loader
				https://github.com/frkngksl/HintInject
				https://github.com/cocomelonc/peekaboo
				https://github.com/Souhardya/ChimeraLdr
				https://github.com/knownsec/shellcodeloader
				https://github.com/xuanxuan0/DripLoader
				https://github.com/NVISOsecurity/DLLoader
				https://github.com/tothi/stager_libpeconv
				https://github.com/ColeHouston/Powershell-DLL-Injection
			Logging
				https://github.com/amrayn/easyloggingpp
				https://github.com/mattiasflodin/reckless
				https://github.com/p-ranav/binary_log
				https://github.com/kala13x/slog
			Macros
				https://github.com/notfoundry/ppstep
				https://github.com/foonathan/debug_assert
			Mach-O
				https://github.com/jevinskie/jevmachopp
			Memory
				https://github.com/JustasMasiulis/memory_signature
			Network
				https://github.com/dsnezhkov/shutter
				https://www.binarytides.com/raw-sockets-c-code-linux/
				https://github.com/libcpr/cpr
				https://github.com/elnormous/HTTPRequest
				https://github.com/yhirose/cpp-httplib
				https://github.com/vcappello/winhttp-wrapper
				https://github.com/sinpolib/sokit
			Obfuscation
				https://github.com/llxiaoyuan/oxorany
				https://github.com/dbaffier/Death
				https://github.com/WindowsCodeCamp/shellcode_obfuscator
				https://github.com/fritzone/obfy
				https://github.com/revsic/cpp-obfuscator
				https://github.com/yoavshah/DataObfuscator
				https://github.com/ITHare/obf
			Packer
				https://ink.library.smu.edu.sg/cgi/viewcontent.cgi?article=3003&context=sis_research
				https://github.com/KooroshRZ/Evader
				* [RibeyeSpecial](https://github.com/apt69/RibeyeSpecial)
			Parsers
			PEs/COFFs/stuff/Loaders
				https://github.com/Ren839/RenJack
				https://github.com/kkent030315/NtSymbol
				https://github.com/Hagrid29/PELoader
				https://github.com/Hagrid29/PELoader
				https://github.com/rwfpl/rewolf-dllpackager
				https://github.com/FULLSHADE/pe-Parser
				https://github.com/OccamsXor/sim-ba
				https://github.com/reverserb/Simple_PE_Loader
			Polymorphism
			Processes (Windows)
			Proxy
				https://github.com/earthquake/Socks5Server
				https://github.com/mattgodbolt/seasocks
			Queue
				https://github.com/rigtorp/SPSCQueue
			Regex
			Serialization
				https://github.com/eyalz800/zpp_bits
			Syscalls
				Linux
				Windows
					https://github.com/adrianyy/x64-syscall
					https://github.com/VeroFess/X64SystemCall
					https://github.com/Chuyu-Team/MINT
					* [Cleancall](https://github.com/jnastarot/cleancall)
						* Library for using direct system calls It automatically detect type of gate for call system call (WOW64 \ Int2E \ Sysenter \ Syscall )
			Testing
				https://github.com/catchorg/Catch2
			Web
				* [How do you make a HTTP request with C++? - Stackoverflow](https://stackoverflow.com/questions/1011339/how-do-you-make-a-http-request-with-c))
			WinAPI
				https://caiorss.github.io/C-Cpp-Notes/WindowsAPI-cpp.html
				https://vulms.vu.edu.pk/Courses/CS410/Downloads/Charles%20Petzold%20-%20Programming%20Windows%20-%205th%20Ed.pdf
			OS Specific
				Linux
				macOS
				Windows
					https://gist.github.com/benpturner/43b46506e4f98e5b860f72c3a6c42367
					https://github.com/JustasMasiulis/nt_wrapper
					https://github.com/lab52io/StealAllTokens
		Crystal
			https://github.com/js-on/WeaponizeCrystal
		CSharp
			https://github.com/thelikes/LikesEvasion
			https://dr4k0nia.github.io/posts/HInvoke-and-avoiding-PInvoke/
			https://www.outflank.nl/blog/2024/02/01/unmanaged-dotnet-patching/
			https://github.com/rasta-mouse/CsWhispers
			https://ipslav.github.io/2023-12-12-let-me-manage-your-appdomain/
			https://github.com/pwn1sher/frostbyte
			https://github.com/Leaked0/Rose-Obfuscator_xRose
			https://github.com/lap1nou/CLR_Heap_encryption
			https://github.com/mrexodia/FunUtils
			https://github.com/LJP-TW/JITHook
			https://ditrizna.medium.com/red-team-use-case-of-open-source-weaponization-5b22b0e287a5
			https://web.archive.org/web/20211226211757/https://threatravens.com/z8j_dt31fu4/
			https://github.com/RedXRanger/StageStrike
			https://github.com/ipSlav/DirtyCLR
			https://github.com/bohops/DynamicDotNet
			https://dr4k0nia.github.io/posts/HInvoke-and-avoiding-PInvoke/
			https://github.com/theart42/Sharpcat
			https://github.com/werdhaihai/SharpAltShellCodeExec
			https://github.com/TheWover/GhostLoader
			https://gist.github.com/byt3bl33d3r/de10408a2ac9e9ae6f76ffbe565456c3
			https://www.rapid7.com/blog/post/2023/05/05/appdomain-manager-injection-new-techniques-for-red-teams/
			https://github.com/TobitoFatitoRE/MemeVM
			https://dr4k0nia.github.io/posts/Encrypting-Strings-In-NET/
			https://github.com/SECFORCE/SharpASM
			https://github.com/Mr-Un1k0d3r/.NetConfigLoader
			https://github.com/Obfuscator-Collections/NashaVM
			https://github.com/clod81/loader_process_hollow_copy_in_chunk
			https://github.com/hotnops/COM_Mapper
			https://github.com/timwhitez/CLR-RWX
			https://github.com/gluck/il-repack
			https://github.com/QuestPDF/QuestPDF
			https://dr4k0nia.github.io/posts/HInvoke-and-avoiding-PInvoke/
			https://dr4k0nia.github.io/posts/NixImports-a-NET-loader-using-HInvoke/
			https://github.com/VollRagm/ShellcodeBakery
			https://electronicbots.github.io/assets/pdf/NET_Loader_Part_1.pdf
			https://github.com/daem0nc0re/SharpWnfSuite
			https://github.com/SteveSyfuhs/Enclave.NET
			https://github.com/dotnet/Kerberos.NET
			https://github.com/Loksie/KoiVM-Virtualization
			https://github.com/georgesotiriadis/MalwareDev
			https://github.com/tandasat/DotNetHooking
			https://github.com/FortyNorthSecurity/Screenshooter
			https://www.fortinet.com/blog/threat-research/debugging-net-malware-in-a-multi-stage-malware-deployment
			https://github.com/lowleveldesign/debug-recipes
			https://posts.specterops.io/dealing-with-failure-failure-escalation-policy-in-clr-hosts-54ca8b728faa
			https://github.com/Sergio0694/BinaryPack
			https://offensivedefence.co.uk/posts/openapi-client-swagger/
			https://github.com/yoda66/MalwareDevTalk
			https://github.com/Kara-4search/PEB-PPIDspoofing_Csharp
			https://github.com/NotPrab/.NET-Obfuscator
			https://github.com/Accenture/Codecepticon
			https://github.com/wsummerhill/CSharp-Alt-Shellcode-Callbacks
			https://github.com/GetRektBoy724/JALSI
			https://offensivedefence.co.uk/posts/implicit-explicit-conversions/
			https://github.com/diljith369/CSharp4Pentesters
			https://github.com/adervis3/dodgEDR
			https://github.com/Shrfnt77/DynamicSyscalls
			https://github.com/arsium/ShellCodeLoaderCSharp
			https://github.com/DamonMohammadbagher/ETWNetMonv3
			https://github.com/flamencist/ldap4net
			https://github.com/FortyNorthSecurity/What-The-F
			https://github.com/Nariod/laz-y
			https://crypt0ace.github.io/posts/Shellcode-Injection-Techniques-Part-2/
			https://gist.github.com/augustoproiete/b51f29f74f5f5b2c59c39e47a8afc3a3
			https://williamknowles.io/quickly-porting-existing-net-projects-for-use-with-bof-net/
			https://github.com/Wra7h/Single-Dose
			https://gitlab.com/KevinJClark/csharptoolbox/-/tree/master
			https://github.com/Accenture/Codecepticon
			https://github.com/SECFORCE/SharpASM
			https://www.secforce.com/blog/sharpasm-sharpwhispers/
			https://github.com/plackyhacker/Shellcode-Encryptor
			https://github.com/post-cyberlabs/Offensive_tools/tree/main/PostDump
			https://github.com/OG-Sadpanda/SharpSword
			https://github.com/Accenture/Codecepticon
			https://github.com/Kara-4search/CreateThreadpoolWait_ShellcodeExecution_CSharp
			https://github.com/winsecurity/Offensive-C-Sharp
			https://www.youtube.com/watch?v=FDwfT1Volfs
			https://github.com/GetRektBoy724/SysGate
			https://github.com/GetRektBoy724/SharpLoadLibrary
			https://github.com/bflattened/bflat
			https://github.com/GetRektBoy724/SharpHalos
			https://crypt0ace.github.io/posts/Shellcode-Injection-Techniques/
			https://github.com/roberreigada/LsassUnhooker
			https://bartunek.me/posts/csharp-stagers/
			https://github.com/Gr1mmie/WMIEnum
			https://gist.github.com/rasta-mouse/2f6316083dd2f38bb91f160cca2088df?permalink_comment_id=4409719#gistcomment-4409719
			https://williamknowles.io/fetching-sharphound-data-entirely-in-memory-no-dropped-zip-or-json-files-using-bof-net-and-cobalt-strike/
			https://github.com/nettitude/RunOF
			https://github.com/sbasu7241/HellsGate
			* [HellsGatePPID](https://github.com/boku7/HellsGatePPID)
			https://github.com/am0nsec/SharpHellsGate
			https://github.com/ChoiSG/SharpPSLoader
			https://github.com/latortuga71/SharpComHijack
			https://github.com/HackingThings/SuperSneakyExec
			https://github.com/post-cyberlabs/Offensive_tools
			https://cocomelonc.github.io/malware/2023/12/25/malware-cryptography-23.html
			https://github.com/SharpC2/SharpC2
			https://github.com/OG-Sadpanda/SharpCat
			https://github.com/HackingThings/SneakyExec
			https://github.com/bflattened/bflat
			* [EasyNet](https://github.com/TheWover/EasyNet)
				* Packs/unpacks arbitrary data using a simple Data -> Gzip -> AES -> Base64 algorithm. Generates a random AES-256 key and and IV and provides them to the user. Can be used to pack or unpack arbitrary data. Provided both as a program and a library.
			* [Inception Framework](https://github.com/two06/Inception)
				* Inception provides In-memory compilation and reflective loading of C# apps for AV evasion. Payloads are AES encrypted before transmission and are decrypted in memory. The payload server ensures that payloads can only be fetched a pre-determined number of times. Once decrypted, Roslyn is used to build the C# payload in memory, which is then executed using reflection.
			* [DotNetToJScript](https://github.com/tyranid/DotNetToJScript)
				* A tool to create a JScript file which loads a .NET v2 assembly from memory.
			* [Payload Generation with CACTUSTORCH](https://www.mdsec.co.uk/2017/07/payload-generation-with-cactustorch/)
				* [Code](https://github.com/mdsecactivebreach/CACTUSTORCH)
			https://github.com/ColeHouston/thread-hijacking-in-csharp
			https://github.com/OG-Sadpanda/SharpExcelibur
			https://offensivedefence.co.uk/posts/assembly-resolve/
			https://williamknowles.io/fetching-sharphound-data-entirely-in-memory-no-dropped-zip-or-json-files-using-bof-net-and-cobalt-strike/
			https://github.com/HackingThings/SuperSneakyExec
			https://github.com/void-stack/VMAttack
			https://github.com/Washi1337/AsmResolver
			https://github.com/sbridgens/ProcessHollowing
			https://dr4k0nia.github.io/posts/NixImports-a-NET-loader-using-HInvoke/?utm_source=substack&utm_medium=email
			https://github.com/RcoIl/CSharp-Tools
			https://github.com/CryptoBreach/UnhookPoC
			https://github.com/notdodo/LocalAdminSharp
			https://github.com/oldboy21/CGPL
			https://github.com/bohops/DynamicDotNet
			https://github.com/ceramicskate0/Ceramic
			AD
			AMSI
			Anti-X
				https://washi.dev/blog/posts/confusing-decompilers-with-call/
				https://github.com/bezzad/AntiDebugging
				https://github.com/Mecanik/Anti-DebugNET
			Assembly Merge
			Backdooring Binaries
				https://www.matteomalvica.com/tutorials/av-evasion/
				https://fullpwnops.com/code-caving/
				https://www.hexacorn.com/blog/2018/07/21/sysmon-doing-lines-part-5/
				* [InfectPE](https://github.com/secrary/InfectPE)
					* Using this tool you can inject x-code/shellcode into PE file. InjectPE works only with 32-bit executable files.
			BOFs
				https://labs.nettitude.com/blog/introducing-runof-arbitrary-bof-tool/
					https://github.com/nettitude/RunOF
			Browsers
			Build
				https://github.com/daveaglick/Buildalyzer
				https://github.com/pardeike/Harmony
			CI/CD
			CLI Params
			Collection
				https://github.com/CCob/Volumiser
				https://github.com/FuzzySecurity/AdvSim.Compression
				https://github.com/OG-Sadpanda/SharpZippo
				https://github.com/DamonMohammadbagher/NativePayloads
				https://labs.nettitude.com/blog/introducing-sharpconflux/
				https://github.com/nettitude/SharpConflux/
				https://rastamouse.me/getdomain-vs-getcomputerdomain-vs-getcurrentdomain/
			COM
			Compression
				https://github.com/adamhathcock/sharpcompress
			Credentials
				https://github.com/Hagrid29/DuplicateDump
			Crypto
			D/Invoke
			Disasm
				https://github.com/spazzarama/SharpDisasm
			Discovery (Local)
				https://github.com/mitchmoser/LACheck
				https://github.com/gh0x0st/wanderer
			Discovery (Network)
			Dlls
			Embedding
			Encryption
			Evasion
				https://github.com/gtworek/PSBits/blob/master/Misc/BreakChain.c
				Callstack Spoofing
			Execution
				https://github.com/HackingThings/SuperSneakyExec
				https://github.com/mez-0/InMemoryNET
				https://github.com/antonioCoco/RunasCs
				https://github.com/slyd0g/UrbanBishopLocal
				https://github.com/thiagomayllart/DarkMelkor
				https://www.accenture.com/us-en/blogs/cyber-defense/clrvoyance-loading-managed-code-into-unmanaged-processes
				https://github.com/D1rkMtr/ExecRemoteAssembly
				https://github.com/jackullrich/universal-syscall-64
			Files
				https://github.com/0xthirteen/FileWriter
			Firewall
			GUI/TUI
				https://github.com/waf/PrettyPrompt
				https://github.com/AvaloniaUI
				https://github.com/jinek/Consolonia
			Hooking
				https://github.com/CCob/MinHook.NET
				https://rastamouse.me/net-startup-hooks/
			Injection
			Lateral Movement
			LNK
			Loader/0or1-Stagers
				https://github.com/CCob/BOF.NET
				https://github.com/VirtualAlllocEx/Shellcode-Downloader-CreateThread-Execution
				https://github.com/clod81/shellcode_runner_copy_in_chunk
				https://github.com/Nariod/Laz-y-templates
				https://github.com/m1ddl3w4r3/ExecRemoteNET
				https://gist.github.com/sdcampbell/41dcaef1068b6b44fd05ac1d3a0dc661
				https://github.com/D4rthMaulCop/DarthLoader
				https://github.com/winsecurity/Offensive-C-Sharp/tree/main/Code%20Injections/PE64Loader/PE64Loader
				https://github.com/hourglass492/Malware-Dev
			JSON
			Managed in UnManaged Code
			Unmanaged in Managed
			Network
				https://github.com/yhirose/cpp-httplib
			Obfuscation
				https://github.com/Dentrax/Z00bfuscator
				https://github.com/h4wkst3r/InvisibilityCloak
				https://github.com/Accenture/Codecepticon
				https://github.com/dr4k0nia/MurkyStrings
				https://vanmieghem.io/towards-generic-.net-obfuscation/
				https://github.com/Accenture/Codecepticon#obfuscating-command-line-arguments
			Packers
				https://github.com/dr4k0nia/Origami
			PE-Loaders
				https://github.com/fullmetalcache/CsharpMMNiceness
			Persistence
			Polymorphism
			PowerShell
				https://icyguider.github.io/2022/01/03/Convert-CSharp-Tools-To-PowerShell.html
			Processes
				https://github.com/plackyhacker/CmdLineSpoofer
			Proxy
				https://github.com/dxflatline/flatpipes
			Recon (Network)
			Registry (Windows)
			Samples
				https://github.com/Idov31/Sandman
			Scheduled Tasks
			Services
			Symbolic Links
			Syscalls
				https://github.com/cube0x0/ParallelSyscalls
				https://github.com/cygnosic/Direct-Syscall
				* [TamperingSyscalls - rad9800](https://fool.ish.wtf/2022/08/tamperingsyscalls.html)
					* [Code](https://github.com/rad9800/TamperingSyscalls)
				* [AtomicSyscall](https://github.com/daem0nc0re/AtomicSyscall)
					* Tools and PoCs for Windows syscall investigation.
			Timestomp
			Training
				https://www.youtube.com/watch?v=KJsVVEn4fFw
				* [C# Workshop - Zac Brown, Greg Bailey, Mike Sullivan(WWHF2019)](https://github.com/redcanaryco/wwhf)
		D
			General
				https://github.com/dlang-community/awesome-d
				https://github.com/dlang-tour/core
			Build
			CLI Params
			Crypto
			Data Storage
			Disasm
			Discovery
			ELF Loader
			Embedded Interpreters/Scripting
			Encryption
			Dropers/Stage0/1 Loaders
			Execution
			GUI/TUi
			JSON
			Loader / Stage0or1
			Network
			Obfuscation
			Parsers
			PEs
			PE Loader
			Polymorphism
			Processes (Windows)
			Regex
			Testing
			OS Specific
				Linux
				macOS
				Windows
					https://github.com/etcimon/windows-headers
		Delphi
			https://github.com/rmusser01/Delphi
			https://github.com/bravesoftdz
			https://github.com/ezequieljuliano/Logging4Delphi
			https://github.com/ezequieljuliano/DelphiLaboratory
			https://github.com/Delphier/TAES
			https://github.com/SyncfusionSuccinctlyE-Books/Delphi-Succinctly
			https://github.com/ezequieljuliano/SQLBuilder4Delphi
		Go
			https://github.com/diljith369/OffensiveGo
			https://github.com/timwhitez/Doge-AddSSP
			https://github.com/timwhitez?tab=repositories
			https://github.com/m13253/dns-over-https
			https://github.com/lunixbochs/struc
			https://github.com/spf13/viper
			https://github.com/gobwas/ws
			https://github.com/guervild/uru
			https://github.com/duke-git/lancet
			https://github.com/aperturerobotics/bifrost
			https://github.com/magisterquis/plonk
			https://github.com/hallazzang/syso
			https://github.com/scriptchildie/goDLLrefletiveloader
			https://github.com/pkujhd/goloader
			https://github.com/knadh/koanf
			https://github.com/omaidf/go-malware
			https://github.com/iDigitalFlame/ThunderStorm
			https://pkg.go.dev/tailscale.com/tsnet
			https://github.com/DongHuangT1/Geacon
			https://github.com/Enelg52/KittyStager
			https://github.com/f1zm0/hades
			https://github.com/haxii/socks-over-https
			https://github.com/WBGlIl/go-ReflectiveDLL
			https://github.com/nodauf/Go-RouterSocks
			https://github.com/charmbracelet/log
			https://github.com/robertkrimen/otto
			https://tacix.at/posts/Babuk%20Source%20Code%20Leak%20-%20Golang%20Encryptor.html
			https://github.com/radovskyb/watcher
			https://github.com/Ne0nd0g/oddments
			https://github.com/yoda66/GoShellcode
			https://github.com/btbd/slew
			https://github.com/sairson/go-Win32Code
			https://github.com/lesnuages/go-execute-assembly
			https://github.com/ropnop/go-clr
			https://github.com/blinkenl1ghts/donloader
			https://github.com/wgpsec/CreateHiddenAccount
			https://github.com/microsoft/go-winio
			https://gist.github.com/CS-5/c251f173e1e8ddd46c1b020427cb239b
			https://github.com/google/gopacket
			https://github.com/mitchellh/go-ps
			https://medium.com/@shantanukhande/red-team-how-to-embed-golang-tools-in-c-e269bf33876a
			https://github.com/burrowers/garble
			https://github.com/hxhBrofessor/Pochita
			https://github.com/3rsh1/goFunctionStomping
			https://github.com/magisterquis/shelloverreversessh
			https://github.com/JustinTimperio/SandMan
			https://github.com/timwhitez/Doge-MemX
			https://github.com/bluesentinelsec/OffensiveGoLang
			https://github.com/dsnezhkov/socksdll
			https://github.com/lucas-clemente/quic-go
			https://github.com/bigb0sss/Bankai
			https://github.com/timwhitez/Doge-WhereAmI
			https://github.com/z505/goDLL
			https://github.com/3rsh1/goGhosting
			https://github.com/nodauf/Swego
			https://github.com/ardanlabs/gotraining
			https://github.com/redcode-labs/GoSH
			https://github.com/yoda66/GoShellcode
			https://github.com/f1zm0/hades
			https://github.com/AllenDang/w32
			https://github.com/sad0p/d0zer
			https://github.com/Ne0nd0g/go-shellcode
			https://github.com/mattn/go-sqlite3
			https://github.com/olekukonko/tablewriter
			https://github.com/gorilla/mux
			https://github.com/0x09AL/go-deliver
			https://github.com/brimstone/go-shellcode
			https://github.com/asmcos/requests
			https://github.com/iamacarpet/go-win64api
			https://github.com/parnurzeal/gorequest
			https://github.com/EgeBalci/amber
			https://www.youtube.com/watch?v=3RQb05ITSyk
			https://github.com/C-Sto/BananaPhone
			* [Go-deliver](https://github.com/0x09AL/go-deliver/)
				* Go-deliver is a payload delivery tool coded in Go. This is the first version and other features will be added in the future.
			* [Hershell](https://github.com/sysdream/hershell)	
				* Simple TCP reverse shell written in Go. It uses TLS to secure the communications, and provide a certificate public key fingerprint pinning feature, preventing from traffic interception.
				* [[EN] Golang for pentests : Hershell](https://sysdream.com/news/lab/2018-01-15-en-golang-for-pentests-hershell/)
			Build
				https://words.filippo.io/shrink-your-go-binaries-with-this-one-weird-trick/
			C2
				https://github.com/dobin/antnium
			CLI Params
			Crypto
			Data Storage
			Disasm
			Discovery
				https://github.com/FourCoreLabs/EDRHunt
				https://github.com/mitchellh/go-ps
			DLLs
				https://github.com/golang/go/wiki/WindowsDLLs
			ELF Loader
			Embedding
				https://github.com/rakyll/statik
			Embedded Interpreters/Scripting
			Encryption
				https://github.com/C-Sto/encembed
			Exfil
				https://github.com/ariary/QueenSono
			Execution
			GUI/TUI
				https://github.com/mathaou/termdbms
				https://github.com/charmbracelet/harmonica
				https://github.com/caarlos0/tasktimer
				https://github.com/charmbracelet/bubbles
				https://github.com/charmbracelet/bubbletea
				https://github.com/owenthereal/ccat
			Injection
				https://github.com/neox41/go-procinject
				https://github.com/jiusanzhou/injgo
			JSON
			Loader/Stage0
				https://github.com/optiv/Freeze
				https://github.com/pench3r/Golang-Shellcode-Loader
				https://github.com/dsnezhkov/SSHoRTy
				* [Metsubushi](https://github.com/ByteJunkies-co-uk/Metsubushi)
					* Generate droppers with encrypted payloads automatically.
			.NET
				https://github.com/lesnuages/go-execute-assembly
			Network
				https://github.com/Dreamacro/clash
				https://github.com/campoy/whispering-gophers
				https://github.com/gowsp/wsp
				https://github.com/latortuga71/Medias
				https://github.com/kost/revsocks
				https://github.com/xjasonlyu/tun2socks/
				https://github.com/nadoo/glider
			Obfuscation
				https://github.com/burrowers/garble
			Parsers
			PEs, DLLs & Their loaders
				https://github.com/EgeBalci/MapPE
				https://github.com/ayoul3/reflect-pe
				https://github.com/Buzz2d0/0xpe
				https://github.com/CCob/goreflect
				https://gist.github.com/leoloobeek/c726719d25d7e7953d4121bd93dd2ed3
				https://github.com/timwhitez/Doge-RL
			Polymorphism
			PowerShell
				https://github.com/40a/go-powershell
			Processes (Windows)
				https://github.com/timwhitez/Doge-RWXenum
				https://kiewic.com/2015-10-11/set-a-breakpoint-in-managed-code-cs-using-windbg
			Regex
			Samples
				* [pneuma](https://github.com/preludeorg/pneuma)
					* Default agent for Prelude Operator
			Shell
				https://github.com/NHAS/reverse_ssh
			Shellcode
				https://keiran.scot/executing-windows-shellcode-in-golang-7be05fea1b86
			Testing
			OS Specific
				Linux
				macOS
				Windows
					https://medium.com/@justen.walker/breaking-all-the-rules-using-go-to-call-windows-api-2cbfd8c79724
		Java(or java-based)
			Build
			C2
				https://github.com/SummerSec/ShiroAttack2
			CLI Params
			Crypto
				* [Javascript -Java compatible encryption: Implementation of Tiny Encryption Algorithm - Emeric Nasi(2011)](http://blog.sevagas.com/?Javascript-Java-compatible-encryption)
			Data Storage
			Disasm
			Discovery
			ELF Loader
			Embedded Interpreters/Scripting
			Encryption
				* [Javascript -Java compatible encryption - seavagas(2011)](http://blog.sevagas.com/?Javascript-Java-compatible-encryption)
			Dropers/Stage0/1 Loaders
				https://github.com/kensh1ro/dart-shellcode
			Execution
			GUI/TUi
			JSON
				https://github.com/safe6Sec/Fastjson
				https://github.com/alibaba/fastjson
			Network
			Obfuscation
			Parsers
			PEs
			PE Loader
			Polymorphism
			Processes (Windows)
			Regex
			Testing
			OS Specific
				Linux
				macOS
				Windows
		JavaScript
			https://github.com/131/node-winapi
			https://github.com/cpueasy/atomic-loader
		Nim
			https://github.com/sh3d0ww01f/nim_shellloader
			https://github.com/frkngksl/UnlinkDLL
			https://www.youtube.com/watch?v=FBuTX6brrsA
			https://www.securityartwork.es/2022/01/12/bypassing-av-edr-with-nim/
			https://github.com/S3cur3Th1sSh1t/NimGetSyscallStub
			https://github.com/OffenseTeacher/Steganim
			https://github.com/OffenseTeacher/NimRekey
			https://github.com/OffenseTeacher/NimDRM
			https://github.com/OffenseTeacher/NimRekey
			https://github.com/ytk2128/pe32-password
			https://github.com/RePRGM/Nimperiments
			https://casvancooten.com/posts/2021/08/building-a-c2-implant-in-nim-considerations-and-lessons-learned/
			https://github.com/zimawhit3/Bitmancer
			https://github.com/nbaertsch/nimvoke
			https://github.com/treeform/puppy
			https://github.com/elddy/Nim-Reverse-Shell
			https://github.com/rbctee/NimScripts/blob/045e64bb2d3be843438a9219183a2f6f15f33ca8/windows/privesc/admin_to_system.nim
			https://www.stevencampbell.info/Offensive-Nim-DLL-Injection/
			https://github.com/zimawhit3/HellsGateNim
			https://github.com/chvancooten/NimPlant
			https://github.com/Ethicalrat/DllSideloader
			https://github.com/dom96/choosenim
			https://github.com/adamsvoboda/nim-loader
			https://github.com/S3lrius/Nimalathatep
			https://github.com/ansiwave/nimwave
			https://github.com/yougar0/net2nimv2
			https://github.com/Haunted-Banshee/ErebusGate
			https://github.com/pruno7/NimGates
			* [deltavfs](https://github.com/ethangreen-dev/deltavfs)
			https://github.com/Cracked5pider/conti_locker
			https://github.com/itaymigdal/NimProtect
			https://github.com/waldo-irc/NimMusings
			https://github.com/daddycocoaman/azbelt
			https://github.com/jangko/nim-noise
			https://github.com/eversinc33/BouncyGate
			https://github.com/icyguider/Nimcrypt2
			https://github.com/icyguider/Nimcrypt2
			https://memn0ps.github.io/Parallel-Syscalls/
				https://github.com/memN0ps/arsenal-rs/tree/main/parallel_syscalls-rs
			https://www.netero1010-securitylab.com/evasion/alternative-process-injection
			https://github.com/zimnyaa/nim-noload-dll-hollowing
			https://github.com/synap5e/onefile_python
			General
				https://github.com/NotoriousRebel/NimbleMusings
				https://github.com/xflywind/awesome-nim
				https://www.youtube.com/watch?v=d2VRuZo2pdA
				https://github.com/ChaitanyaHaritash/NIM-Scripts
				https://github.com/frkngksl/ParallelNimcalls
				https://github.com/chvancooten/NimPackt-v1
				https://github.com/zimawhit3/DynimicGhostWriting
				https://github.com/HuskyHacks/the-crown-defcon615
				https://github.com/zimawhit3/HellsGateNim
				https://github.com/sergiotapia/nimlings
				https://github.com/S3cur3Th1sSh1t/NimWinstaEveryoneAccess
			ASM
			Build
				https://github.com/Yardanico/cosmonim
				https://github.com/Yardanico/nim-strenc
				https://github.com/optiv/Mangle
				https://hookrace.net/blog/nim-binary-size/
			C2
				https://github.com/d4rckh/nimc2
				https://github.com/itaymigdal/Nimbo-C2
			CLI Params
			Crypto
				https://github.com/jangko/nimAES
				https://github.com/Yardanico/nim-strenc
			Data Storage
			Disasm
			Discovery
			ELF Loader
			Embedded Interpreters/Scripting
			Encryption
			Execution
				https://github.com/Nariod/Chocolatine
				* [bof-lazy-loading](https://tishina.in/execution/bof-lazy-loading)
					* This article presents an easy/lazy way of integrating BOFs into your nim projects without implementing a full-scale COFF loader. This is a way I've first seen implemented in sliver C2.
			Evasion
				https://github.com/whydee86/SnD_AMSI
				Callstack Spoofing
					https://github.com/danielkrupinski/x86RetSpoof
					https://github.com/frkngksl/NimicStack
				Memory
					https://github.com/pruno7/nEkko
			GUI/TUi
				https://github.com/nim-lang/Nim/wiki/Curated-Packages#gui
				* [illwill](https://github.com/johnnovak/illwill)
					* illwill is a (n)curses inspired simple terminal library that aims to make writing cross-platform text mode applications easy. Having said that, it's much simpler than (n)curses and it's not as robust by far in terms of supporting different encodings, terminal types, etc. The aim was to write something small and simple in pure Nim that works for 99% of users without requiring any external dependencies or a terminfo database.
				* [Figma](https://github.com/treeform/fidget)
					* Figma based UI library for nim, with HTML and OpenGL backends. 
				* [NimCocoa](https://github.com/Airr/nim-cocoa)
					* NimCocoa is an experimental implementation of a Native GUI for the Nim programming language running on macOS.
			Injection
				https://github.com/Moriarty2016/NimRDI
				https://github.com/kensh1ro/syscall_nimject
				https://github.com/snovvcrash/NimHollow
				https://github.com/Moriarty2016/NimRDI
				https://github.com/Wra7h/SharpGhosting
			InterOp
				C
					https://nim-lang.org/docs/manual.html#foreign-function-interface-importc-pragma
			JSON
			Loader(Shellcode) / Stage0or1
				https://tishina.in/execution/bof-lazy-loading
				https://casvancooten.com/posts/2021/08/building-a-c2-implant-in-nim-considerations-and-lessons-learned/
				https://ilankalendarov.github.io/posts/nim-ransomware/
				https://github.com/aeverj/NimShellCodeLoader	
				https://github.com/frkngksl/NiCOFF
				https://medium.com/@lsecqt/developing-smb-stager-in-nim-8832e5986a85
				https://github.com/S3cur3Th1sSh1t/Nim_CBT_Shellcode
			Network
			Obfuscation
			Packers/Crypters
				https://github.com/icyguider/nimcrypt
				https://github.com/S3lrius/Nimalathatep
			Parsers
			PEs & Loaders thereof
				https://github.com/S3cur3Th1sSh1t/Nim-RunPE
				https://github.com/khchen/memlib
			Polymorphism
			Processes (Windows)
			Python
				https://github.com/yglukhov/nimpy
			Regex
			Shellcode
				https://github.com/adamsvoboda/nim-loader
			Testing
			OS Specific
				Linux
				macOS
				Windows
					https://github.com/OlivierLaflamme/NimiDumpWriteDump/blob/main/minidump.nim
					https://github.com/ajpc500/NimlineWhispers2
					https://github.com/ChaitanyaHaritash/NIM-Scripts/tree/main/TokenImpersonation
					https://github.com/HuskyHacks/ShadowSteal
					https://huskyhacks.dev/2021/07/17/nim-exploit-dev/
					https://github.com/khchen/winim
		Objective-C
			Capture/Collection
				https://github.com/rharder/imagesnap
		Pascal
			https://github.com/nickVorobiow/Compiler
			https://github.com/FrozenGene/LLVMPascalCompiler
			https://github.com/lkesteloot/turbopascal
			https://0xsp.com/security%20research%20%20development%20srd/building-mini-c2c-in-pascal-part-1/
			https://github.com/lobtao/Process
			https://github.com/x140y40/Asena
			https://0xsp.com/security%20research%20%20development%20srd/building-mini-c2c-in-pascal-part-3/
			https://github.com/lhengen/hcUpdateFramework
			https://github.com/h4sh3m/Simple-Loader
			https://github.com/ztl8702/gochat
			https://github.com/0xsp-SRD/mortar
				https://0xsp.com/security%20research%20%20development%20srd/defeat-the-castle-bypass-av-advanced-xdr-solutions/
				https://0xsp.com/offensive/mortar-loader-v2/
			https://github.com/0xsp-SRD/OffensivePascal
		Perl
			https://github.com/htrgouvea/spellbook
		PowerShell
			https://github.com/ahhh/go-powershell
			https://github.com/airbus-cert/Invoke-Bof
			https://github.com/DarkCoderSc/PowerRemoteDesktop/tree/main/PowerRemoteDesktop_Viewer
			https://skyblue.team/posts/invoke-bof/
			https://github.com/mindcrypt/powerglot
				https://raw.githubusercontent.com/mindcrypt/my_talks/main/Powerglot%20-%20Dr.%20Alfonso%20Mu%C3%B1oz%20-%20BH-EU2020.pdf
			https://github.com/Idov31/MrKaplan
			https://github.com/latortuga71/TortugaToolKit
			https://github.com/jdhitsolutions/PSRemoteOperations
			https://github.com/leechristensen/OffensivePowerShellTasking
			* [Powershell Download Cradles - Matthew Green](https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html)
			* [Invoke-PSImage](https://github.com/peewpw/Invoke-PSImage)
				* Invoke-PSImage takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image. It generates a oneliner for executing either from a file of from the web (when the -Web flag is passed). The least significant 4 bits of 2 color values in each pixel are used to hold the payload. Image quality will suffer as a result, but it still looks decent. The image is saved as a PNG, and can be losslessly compressed without affecting the ability to execute the payload as the data is stored in the colors themselves. It can accept most image types as input, but output will always be a PNG because it needs to be lossless. Each pixel of the image is used to hold one byte of script, so you will need an image with at least as many pixels as bytes in your script. This is fairly easy—for example, Invoke-Mimikatz fits into a 1920x1200 image.
			* [Reverse Encrypted (AES 256-bit) Shell over TCP - using PowerShell SecureString.](https://github.com/ZHacker13/ReverseTCPShell)
			* [PowerDNS](https://github.com/mdsecactivebreach/PowerDNS)	
				* PowerDNS is a simple proof of concept to demonstrate the execution of PowerShell script using DNS only. PowerDNS works by splitting the PowerShell script in to chunks and serving it to the user via DNS TXT records.
			Samples (Notable)
				* [pwncat - calebstewart](https://github.com/calebstewart/pwncat)
					* pwncat is a raw bind and reverse shell handler. It streamlines common red team operations and all staging code is from your own attacker machine, not the target.
				* [pwncat - cytopia](https://github.com/cytopia/pwncat)
					* pwncat - netcat on steroids with Firewall, IDS/IPS evasion, bind and reverse shell, self-injecting shell and port forwarding magic - and its fully scriptable with Python (PSE)
		Python
			https://github.com/naksyn/Embedder
			https://github.com/x4nth055/pythoncode-tutorials
			https://blog.fox-it.com/2024/01/25/memory-scanning-for-the-masses/
				https://github.com/fox-it/skrapa
			https://github.com/dhondta/python-codext
			https://devblogs.microsoft.com/powershell/hosting-powershell-in-a-python-script/
			https://github.com/peterbrittain/asciimatics
			https://github.com/jborean93/pypsrp
			https://hackmag.com/security/python-pyramid/
			https://github.com/naksyn/Embedder
			https://ep2019.europython.eu/media/conference/slides/8MGqsQG-auditing-hooks-and-security-transparency-for-cpython.pdf
			https://github.com/prompt-toolkit/python-prompt-toolkit
			https://beeware.org/
			https://click.palletsprojects.com/en/8.1.x/
			https://github.com/simonw/sqlite-utils
			https://github.com/exaloop/codon
			https://github.com/Textualize/rich-cli
			https://www.bc-security.org/post/weaponizing-webdav-for-offensive-security/
			https://github.com/MaxHalford/chime
			https://github.com/Psmths/reave
			https://github.com/cybiere/baboossh
			https://www.youtube.com/playlist?list=PLqz80p7f6dFuUktSIY_Lpk9mlw2JrC7A9
			https://github.com/naksyn/PythonMemoryModule
			https://github.com/zimnyaa/inmembof.py
			https://github.com/dapper91/pjrpc
			https://github.com/naksyn/Pyramid
			https://github.com/ins1gn1a/Frampton
			https://infosecwriteups.com/pythonic-malware-part-3-in-memory-execution-and-modern-evasion-ec3cc1084628
			https://github.com/hakril/PythonForWindows
			https://klezvirus.github.io/RedTeaming/Development/ImplementingLDAPScanner/
			https://github.com/analyserdmz/PyJector
			https://github.com/rkbennett/pybof
			https://github.com/hlldz/SpookFlare
			https://peterjson.medium.com/miracle-one-vulnerability-to-rule-them-all-c3aed9edeea2
			https://github.com/operatorequals/httpimport
			https://blog.didierstevens.com/2021/07/19/using-sebackupprivilege-with-python/
			https://github.com/JrM2628/httpworker
			https://github.com/Maratyszcza/PeachPy
			https://github.com/tid4l/TallGrass
			https://mwax911.medium.com/building-a-plugin-architecture-with-python-7b4ab39ad4fc
			https://eli.thegreenplace.net/2012/08/07/fundamental-concepts-of-plugin-infrastructures
			https://github.com/Qazeer/OffensivePythonPipeline
			https://github.com/lexfo/rpc2socks
			https://www.bc-security.org/post/rebuilding-ironnetinjector-turlas-ironpython-toolkit/
			https://github.com/dievus/PythonCreateYourOwnSeries
			https://www.hackthebox.com/blog/windows-protocols-python
			https://www.youtube.com/watch?v=VEy-Zh2Fh-4
			https://github.com/naksyn/PythonMemoryModule
			https://github.com/preludeorg/vertebrae
			https://tishina.in/execution/pyd-execute-assembly
			https://github.com/exaloop/codon
			https://isc.sans.edu/diary.html?storyid=0
			https://github.com/htr-tech/PyObfuscate
			https://news.ycombinator.com/item?id=34968186
			https://github.com/russnes/rust_python_package_example
			https://github.com/JamesWTruher/PsPython
			https://www.bc-security.org/post/weaponizing-webdav-for-offensive-security/
			https://www.bc-security.org/post/rebuilding-ironnetinjector-turlas-ironpython-toolkit/
			Build
				* [tinypy](https://github.com/rainwoodman/tinypy)
			CLI Params
				https://github.com/google/python-fire
			Crypto
				https://github.com/keybase/python-salsa20
				https://github.com/skelsec/unicrypto
			Data Storage
			Disasm
			Discovery
			ELF Loader
			Embedded Interpreters/Scripting
			Encryption
			Dropers/Stage0/1 Loaders
			Execution
			GUI/TUi
				https://github.com/bczsalba/pytermgui
				https://github.com/Textualize/rich
				https://github.com/Textualize/textual
				https://github.com/hoffstadt/DearPyGui
				https://github.com/zauberzeug/nicegui
			Injection
				https://github.com/kmaork/pyinjector
				https://github.com/kmaork/hypno
			JSON
			Loader / Stage0or1
				https://github.com/shogunlab/Sukoshi/blob/main/README.md
				https://github.com/0xCyberY/Antivirus-Evasion-Py2exe
				https://github.com/mertdas/Slayer
				https://github.com/scythe-io/in-memory-cpython
				https://github.com/ChadMotivation/TymSpecial
				* [Pupy](https://github.com/n1nj4sec/pupy)
					* Pupy is a remote administration tool with an embeded Python interpreter, allowing its modules to load python packages from memory and transparently access remote python objects. The payload is a reflective DLL and leaves no trace on disk
				* [Winpayloads](https://github.com/nccgroup/Winpayloads)
					* Undetectable Windows Payload Generation with extras Running on Python2.7
				* [Cloak](https://github.com/UltimateHackers/Cloak)
					* Cloak generates a python payload via msfvenom and then intelligently injects it into the python script you specify.
			Network
				https://github.com/laike9m/PyPunchP2P
			Obfuscation
			Parsers
			PEs
			PE Loader
			Polymorphism
			Processes (Windows)
			Regex
			RemoteLoad
				https://github.com/sulinx/remote_importer
				https://www.xorrior.com/In-Memory-Python-Imports/
				https://ajpc500.github.io/c2/In-memory-Python-Modules-With-The-Medusa-Mythic-Agent/
			Serialization
				https://github.com/uqfoundation/dill
			Shellcode
				https://github.com/thesp0nge/shellerate
			Testing
			OS Specific
				Linux
				macOS
				Windows
					https://github.com/RixedLabs/IDLE-Abuse
					https://github.com/hakril/PythonForWindows
					https://securityboulevard.com/2023/06/when-byte-code-bites-who-checks-the-contents-of-compiled-python-files/
					https://github.com/bigb0sss/RedTeam-OffensiveSecurity/tree/master/02-Windows_Security
					https://github.com/BorjaMerino/Pazuzu
					https://briefcase.readthedocs.io/en/stable/
					https://www.trustedsec.com/blog/obfuscation-using-python-bytecode/
			ToOtherLang
				https://github.com/cython/cython
			https://github.com/fox-it/dissect.cstruct
			https://github.com/mitsuba-renderer/nanogui
			https://github.com/SilverTuxedo/keval
			https://github.com/erocarrera/pefile
			* [Code injection on Windows using Python: a simple example - andreafortuna](https://www.andreafortuna.org/programming/code-injection-on-windows-using-python-a-simple-example/)
			* [pyrasite](https://github.com/lmacken/pyrasite)
				* Tools for injecting arbitrary code into running Python processes.
			* [Equip: python bytecode instrumentation](https://github.com/neuroo/equip)
				* equip is a small library that helps with Python bytecode instrumentation. Its API is designed to be small and flexible to enable a wide range of possible instrumentations. The instrumentation is designed around the injection of bytecode inside the bytecode of the program to be instrumented. However, the developer does not need to know anything about the Python bytecode since the injected code is Python source.
			https://isc.sans.edu/diary/Python+Shellcode+Injection+From+JSON+Data/28118
			https://tpetersonkth.github.io/2021/10/16/Creating-a-Basic-Python-Reverse-Shell-Listener.html
			https://github.com/dhondta/python-sploitkit
			* [Proxy Method – Python Design Patterns - chaudhary_19](https://www.geeksforgeeks.org/proxy-method-python-design-patterns/)
			https://github.com/tylerhou/fiber
			Collection
				https://github.com/dievus/Firefox-Dumper/blob/main/firefoxdumper.py
				* [localdataHog](https://github.com/ewilded/localdataHog)
					* String-based secret-searching tool (high entropy and regexes) based on truffleHog. The main difference is that whereas truffleHog was built with git repositories in mind, this tool is an attempt of applying truffleHog approach (potential secret searching leveraging both regular expressions and entropy calculation) against any data (although for it to be effective, data should not be encoded nor compressed).
			Exfil
				https://github.com/foofus-sph1nx/PyMailSniper
			GUI/TUI
				https://github.com/tqdm/tqdm
				https://github.com/hoffstadt/DearPyGui
			Loader/Stage0_or_1
				https://github.com/persianhydra/Xeexe-TopAntivirusEvasion
			Logging
				https://github.com/hynek/structlog
			Network
				https://github.com/evanRubinsteinIT/socketScanner
			Packer
				* [Phantom-Evasion](https://github.com/oddcod3/Phantom-Evasion)
					* Phantom-Evasion is an antivirus evasion tool written in python (both compatible with python and python3) capable to generate (almost) fully undetectable executable even with the most common x86 msfvenom payload.		Novel
			https://github.com/adamdriscoll/snek
			https://github.com/krabelize/icmpdoor
		Ruby
			https://github.com/Zeop-CyberSec/windows_defender_exe2
			https://github.com/kensh1ro/offensive-ironruby
			https://ronin-rb.dev/blog/2023/02/01/ronin-2-0-0-finally-released.html
		Rust
			https://llogiq.github.io/2024/03/28/easy.html
			https://github.com/memN0ps/rdi-rs
			https://github.com/quinn-rs/quinn
			https://memn0ps.github.io/why-rust-or-offensive-rust/
			https://github.com/CoolerVoid/Rust_survival_tricks
			https://github.com/Kudaes/Shelter
			https://github.com/gmh5225/rust-Shellcode-Loader-Pestilence
			https://github.com/r4ime/shellcode_loader
			https://steve-s.gitbook.io/0xtriboulet/ttps/ttps-rust-vs-c++
			https://github.com/b1tg/rs_shellcode
			https://github.com/ufrisk/pdbcrust
			https://github.com/brundonsmith/rust_lisp
					https://github.com/not-matthias/mmap/
			https://github.com/joaoviictorti/RustRedOps
			https://github.com/elast0ny/shared_memory
			https://github.com/josephg/jumprope-rs
			https://github.com/Kudaes/rust_tips_and_tricks
			https://github.com/memN0ps/ekko-rs
			https://github.com/memN0ps/mordor-rs
			https://github.com/2vg/blackcat-rs/tree/master/crate/mini-sRDI
			https://github.com/Ben-Lichtman/reloader
			https://github.com/0xor0ne/recmd
							https://github.com/wumb0/rust_bof
				https://github.com/yamakadi/ldr
			https://github.com/memN0ps/mmapper-rs
			https://steve-s.gitbook.io/0xtriboulet/zerototal/zerototal-rusty-calc
			https://github.com/memN0ps/srdi-rs
			https://steve-s.gitbook.io/0xtriboulet/ttps/ttps-rust-vs-c++
			https://github.com/TheDuchy/rdtsc-cpuid-vm-check
			https://github.com/Signal-Labs/iat_unhook_sample
			https://github.com/lifting-bits/microx
			https://github.com/XaFF-XaFF/ZwProcessHollowing
			https://github.com/winsecurity/Offensive-Rust
			https://github.com/trickster0/UDPlant
			https://deterministic.space/bevy-labels.html
			https://github.com/hugsy/ropgadget-rs
			https://github.com/hyperium/http
			https://github.com/Nariod/Tartocitron
			https://jfmaes-1.gitbook.io/emulate-like-a-champ-emulating-the-latest-buer-cam/lab-0-setup
			https://www.msuiche.com/posts/poc-2022-korea-keynote/
			https://mehrn00.github.io/blog/posts/
			https://www.secureideas.com/blog/how-to-obfuscate-strings-in-rust-the-easy-way-using-the-litcrypt-crate
			https://github.com/Kudaes
			https://github.com/maciej-irl/objc_rust
			https://github.com/tw93/Pake
			https://github.com/winsecurity/Offensive-Rust
			https://github.com/ASkyeye/rust_bof
			https://github.com/WANG-lp/socks5-rs
			https://github.com/yamakadi/clroxide
			https://github.com/sharkdp/bat
			https://blessed.rs/crates
			https://github.com/malware-unicorn/rusty-memory-loadlibrary
			https://github.com/memN0ps/arsenal-rs
			https://raphlinus.github.io/rust/gui/2022/05/07/ui-architecture.html
			https://github.com/HuskyHacks/RustyProcessInjectors
			https://github.com/cloudflare/boringtun
			https://github.com/Idov31/Nidhogg
			https://aws.amazon.com/blogs/security/introducing-s2n-quic-open-source-protocol-rust/
			https://github.com/sunface/rust-by-practice
			https://github.com/HuskyHacks/RustyTokenManipulation
			https://github.com/trickster0/RedLizard
			https://github.com/paritytech/jsonrpc
			https://github.com/kmanc/remote_code_oxidation
			https://practice.rs/why-exercise.html
			ASM
			BOFs
				https://github.com/wumb0/rust_bof
			Build
				https://github.com/rust-embedded/cross
				https://github.com/sagiegurari/cargo-make#usage-ci-travis
				https://github.com/johnthagen/min-sized-rust
			CLI Params
			CredAtk
				https://github.com/memN0ps/mimiRust
			Crypto
			Data Storage
			Disasm
			Discovery
				https://github.com/praetorian-inc/noseyparker
			Dropers/Stage0/1 Loaders
				https://github.com/whokilleddb/exe_who
			ELF Loader
			Embedded Interpreters/Scripting
			Encryption
			Evasion
				https://github.com/trickster0/EDR_Detector
				https://github.com/Kudaes/RustChain
			Execution
			GUI/TUi
				https://github.com/emilk/egui
			(Un-)Hooking
				https://github.com/thiagopeixoto/massayo
			Injection
				https://github.com/CooperShield/rustache_injector
				https://github.com/HuskyHacks/RustyProcessInjectors
			JSON
				https://github.com/yamafaktory/jql
			Loader / Stage0or1
			Network
				https://github.com/b1tg/proxy-for-dummies
				https://github.com/cloudflare/boringtun
			Obfuscation
				https://github.com/CasualX/obfstr
			Packers
				https://github.com/Nariod/RustPacker
			Parsers
			PEs
			PE Loader
				https://github.com/whokilleddb/exe_who
			Polymorphism
			Processes (Windows)
			Regex
			Testing
			OS Specific
				Linux
				macOS
				Windows
			https://github.com/Kudaes/DInvoke_rs
			https://github.com/rmccrystal/kernel-rs
			https://github.com/steele123/mem-rs
			https://github.com/postrequest/link
			https://github.com/trickster0/OffensiveRust/blob/master/Injection_AES_Loader/src/main.rs
			https://github.com/zorftw/kdmapper-rs
			https://github.com/woodruffw/toml2json
			https://github.com/postrequest/link
			https://github.com/EddieIvan01/memexec
			https://github.com/str4d/rage
			https://github.com/CoolerVoid/Rust_survival_tricks
			https://github.com/trickster0/EDR_Detector
			https://crates.io/crates/windows-sys
			https://github.com/tokio-rs/tokio
			https://github.com/zerosum0x0/SassyKitdi
			https://github.com/GuillaumeGomez/sysinfo
			https://github.com/resyncgg/dacquiri
			https://github.com/RazrFalcon/memmap2-rs
			https://github.com/trickster0/OffensiveRust
			https://github.com/alexchandel/screenshot-rs
			https://github.com/vfsfitvnm/intruducer
			https://github.com/gamozolabs/elfloader
			https://github.com/dtolnay/gflags
			https://github.com/uutils/coreutils
			https://github.com/sagiegurari/duckscript
			GUI/TUI
				https://github.com/athre0z/zzz
				https://github.com/Julien-R44/cli-candlestick-chart
			Network
				https://github.com/tafia/quick-protobuf
			Search
				https://github.com/pipedown/noise
			Shellcode
				https://kerkour.com/rust-execute-from-memory/
				https://kerkour.com/shellcode-in-rust/
				https://kerkour.com/rust-position-independent-shellcode/
			PE
				https://github.com/adrianyy/pe64-parse
			TLS
				https://github.com/siketyan/sltunnel
		V
			https://github.com/diljith369/OffensiveVLang
		VBA
			https://raw.githubusercontent.com/BC-SECURITY/Offensive-VBA-and-XLS-Entanglement/main/XLS_Entanglement_Whitepaper.pdf
			https://www.bc-security.org/post/xls-entanglement/
			https://github.com/DISREL/Ring0VBA
				https://disrel.com/posts/Ring0VBA-Getting-Ring0-Using-a-Goddamn-Word-Document/
			* [Hacking in an epistolary way: implementing kerberoast in pure VBA - Adepts of 0xCC(2020)](https://adepts.of0x.cc/kerberoast-vba-macro/)
				* [VBad](https://github.com/Pepitoh/VBad)
					* VBad is fully customizable VBA Obfuscation Tool combined with an MS Office document generator. It aims to help Red & Blue team for attack or defense.
			Execution
				https://github.com/med0x2e/vba2clr
				https://adepts.of0x.cc/alternatives-copy-shellcode/
		VB.NET
			https://github.com/VbScrub/GetDomainSID
		Zig
			https://github.com/darkr4y/OffensiveZig
			https://github.com/ratfactor/ziglings
	Linux - qwerty
		https://blog.cloudflare.com/how-to-execute-an-object-file-part-1/
		https://github.com/phath0m/JadedWraith
		https://0x00sec.org/t/writing-a-simple-rootkit-for-linux/29034
		https://github.com/yugr/Implib.so
		https://tishina.in/execution/linux-evasion-primitives
		https://github.com/zimnyaa/LEOPARDSEAL
		https://www.guitmz.com/
		https://www.youtube.com/watch?v=sqAA-qBnKTM
		https://github.com/redcode-labs/Neurax
		https://0xax.gitbooks.io/linux-insides/content/index.html
		https://sysprog21.github.io/lkmpg/
		https://github.com/matheusmoreira/liblinux
		https://github.com/romainthomas/the-poor-mans-obfuscator
		https://github.com/kyleavery/pendulum
		https://github.com/nccgroup/thetick
		https://github.com/alichtman/malware-techniques
		https://labs.withsecure.com/publications/executing-arbitrary-code-executables-in-read-only-filesystems
		https://offlinemark.com/2021/05/12/an-obscure-quirk-of-proc/
		https://github.com/dsnezhkov/elfpack
		https://github.com/ariary/fileless-xec
		https://github.com/yrp604/rappel
		https://github.com/aristocratos/btop
		https://cocomelonc.github.io/tutorial/2021/09/11/reverse-shells.html
		https://www.guitmz.com/
		https://www.kitploit.com/2022/02/elfloader-architecture-agnostic-elf.html?m=1
		https://www.guitmz.com/linux-midrashim-elf-virus/
		https://github.com/curtiszimmerman/rcp100
		* [Hangover](https://github.com/AndreRH/hangover)
			* Hangover runs simple Win64/Win32 applications on arm64/ppc64le/x86_64 Linux and x86_64 Mac		
		Anti-Dbg
			https://github.com/Luis-Hebendanz/0pack
		ASM
			https://tmpout.sh/2/1.html
		Bash
			Args
				https://github.com/Anvil/bash-argsparse
		Build
			https://tratt.net/laurie/blog/2022/whats_the_most_portable_way_to_include_binary_blobs_in_an_executable.html
			https://github.com/NewWorldComingSoon/llvm-msvc
		Collection
			https://zeronights.ru/wp-content/uploads/2021/09/09_agarkov.pdf
			https://github.com/annmuor/zn2021_8ways
		Disco
			https://github.com/dylanaraps/neofetch
		ELF
			https://github.com/elfmaster/scop_virus_paper
			https://gist.github.com/zznop/0117c24164ee715e750150633c7c1782
			https://github.com/elfmaster/saruman
			https://github.com/dsnezhkov/elfpack
			https://github.com/BR903/ELFkickers
			https://www.intezer.com/blog/malware-analysis/executable-linkable-format-101-part-4-dynamic-linking/
			https://n0.lol/ebm/1.html
			https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html
			https://n0.lol/ebm/2.html
			https://n0.lol/ebm/3.html
			https://n0.lol/ebm/4.html
			https://github.com/DavidBuchanan314/stelf-loader
			https://github.com/arget13/memdlopen
			https://github.com/d3npa/experiments/tree/master/quick_elf_patching_in_rust
			https://github.com/ulexec/SHELF-Loading
			https://github.com/gamozolabs/elfloader
			https://github.com/trustedsec/ELFLoader
			https://www.trustedsec.com/blog/elfloader-another-in-memory-loader-post/
			https://www.youtube.com/watch?v=nC1U1LJQL8o
			https://lief-project.github.io/doc/latest/tutorials/04_elf_hooking.html
		Evasion
			https://tishina.in/execution/linux-evasion-primitives
			https://odysee.com/@HackerSploit:26/linux-red-team-defense-evasion:f
			Packers
				https://github.com/neurobin/shc
		Execution
			https://github.com/kiks7/KRWX
		Hooking
			https://github.com/stdhu/kernel-inline-hook
		Injector
			https://github.com/namazso/linux_injector
		Loader
			https://github.com/EvanMcBroom/fuse-loader
			ELF
				https://github.com/infosecguerrilla/ReflectiveSOInjection
				https://blog.sektor7.net/#!res/2020/meterp-inject-yt.md
				https://blog.sektor7.net/#!res/2020/../../res/2018/pure-in-memory-linux.md
				https://blog.cloudflare.com/how-to-execute-an-object-file-part-1/
				https://blog.cloudflare.com/how-to-execute-an-object-file-part-2/
				https://jericho.blog/2022/12/01/rebuttal-not-really-comments-on-curpheys-latest-blog/
		Networking
			https://github.com/turbo/nuTLS
			https://github.com/fksvs/inject
			https://github.com/zfl9/dns2tcp
			https://github.com/zfl9/ipt2socks
		Obfuscation
			https://github.com/BlobbyBob/PtraceObfuscator
			* [Anti-UPX Unpacking Technique - Shusei Tomonaga(2022)](https://blogs.jpcert.or.jp/en/2022/03/anti_upx_unpack.html)
				* "This blog article explains the details of Anti-UPX Unpacking technique, which is often applied to Linux-targeting malware."
		Processes
			https://github.com/ekknod/rx
		Rootkits
			https://github.com/NoviceLive/research-rootkit
			https://h0mbre.github.io/Learn-C-By-Creating-A-Rootkit/#
			https://www.wiz.io/blog/linux-rootkits-explained-part-1-dynamic-linker-hijacking
		Shellcoding
			https://cocomelonc.github.io/tutorial/2021/10/09/linux-shellcoding-1.html
			https://cocomelonc.github.io/tutorial/2021/10/17/linux-shellcoding-2.html
			https://modexp.wordpress.com/2022/05/02/shellcode-risc-v-linux/
			https://github.com/voydstack/shellcoding
			* [BMJ](https://github.com/redcode-labs/BMJ)
				* BMJ contains low-level code fragments (in a form of NASM macros) that can assist in writing small, position-independent and null-free shellcode. Most of the macros communicate directly with the kernel - no external dependencies (such as glibc) are needed, so the code is portable across all 64-bit GNU/Linux systems.
		TImers
			https://redplait.blogspot.com/2022/12/timers-in-linux-kernel.html
	LLVM
		https://www.youtube.com/watch?v=J5xExRGaIIY&t=748s
	MacOS - qwerty
		https://reverse.put.as/2021/12/17/knock-knock-whos-there/
		https://github.com/AutomoxSecurity/iShelly
		https://github.com/tpoechtrager/osxcross
	Windows - qwerty		
		https://insight--jp-nttsecurity-com.translate.goog/post/102id12/bsides-tokyo-2023-power-automate-packing?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp
		https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
			https://github.com/LloydLabs/ntqueueapcthreadex-ntdll-gadget-injection/blob/dev/src/main.c
		https://mp-weixin-qq-com.translate.goog/s/ggB_XarThtTA_tI44k054w?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp
		https://github.com/rad9800/WTSRM2
		http://www.rohitab.com/discuss/topic/38988-nebbetts-shuttle-for-win7/
			https://groups.google.com/g/comp.os.ms-windows.programmer.win32/c/Md3GKPc279A/m/Ax3bYgXhpD8J?pli=1
			http://www.rohitab.com/discuss/topic/37801-question-memory-execution/?p=10083457#entry10083457
		https://twitter.com/modexpblog/status/1642813659742195712
			https://gist.github.com/odzhan/fe278c2588e462edf3a9fd61f3c51d93
		https://github.com/alfarom256
		https://github.com/hackerhouse-opensource/WMIProcessWatcher
		https://github.com/pTerrance/alpc-km-um
		https://github.com/prsyahmi/GpuRamDrive
		https://github.com/dsnezhkov/shutter
		https://github.com/Maldev-Academy/Christmas
		https://github.com/nickvourd/Supernova
		https://bananamafia.dev/post/reinschauer/
		https://whiteknightlabs.com/2024/02/09/a-technical-deep-dive-comparing-anti-cheat-bypass-and-edr-bypass
		https://github.com/EvanMcBroom/perfect-loader?utm_source=substack&utm_medium=email
		https://www.deleaker.com/
		https://medium.com/@br4nsh/a-meterpreter-and-windows-proxy-case-4af2b866f4a1
		https://github.com/mrexodia/phnt-single-header
		https://agner.org/optimize/
		https://github.com/rad9800/WTSRM
		* [Playing with PuTTY - Tim Carrington(2021)](https://labs.withsecure.com/blog/playing-with-putty/)
		https://github.com/benheise/TitanLdr
		* [MSVC-CRT - Rolf Rolles](https://github.com/RolfRolles/Miscellaneous/blob/master/MSVC-CRT.md)
			* "`In case you're reverse engineering a C++ program compiled with MSVC, and you can't match the binary to the headers on your machine, here is a list of repositories that contain various versions of the MSVC C/C++ CRT. I collected these by searching GitHub for filename:crtversion.h _VC_CRT_BUILD_VERSION and removing duplicates. (That constant was introduced in 10.0; for earlier versions, search for filename:crtassem.h _CRT_ASSEMBLY_VERSION.)`"
		https://gist.github.com/sbasu7241/bfcdd24492182f9143d99c45853efc42
			https://securelist.com/a-new-secret-stash-for-fileless-malware/106393/
		* [Toying with inheritance - hexacorn](http://www.hexacorn.com/blog/2019/06/15/toying-with-inheritance/)
		https://gist.github.com/odzhan/56eb105a611dcdebd1d3a084c7312190
		https://github.com/xenoscr/compressedCredBandit/blob/main/src/compressedCredBandit.c#L751
		https://github.com/WKL-Sec/HiddenDesktop/blob/14252f58e3f5379301f0d6334f92f8b96f321a16/client/scmain.c#L125
		https://github.com/thiagopeixoto/winsos-poc
		https://winslow1984.com/books/malware/page/reflectiveloading-and-inflativeloading
		 https://gitlab.com/ORCA666/relocalloc	
		https://signal-labs.com/parsing-msdn-for-documented-technique-dev/
		https://kwcsec.gitbook.io/the-red-team-handbook/techniques/defense-evasion
		https://github.com/SaulBerrenson/WinApiObfuscator
			* [inceptor](https://github.com/klezVirus/inceptor)
				* Template-Driven AV/EDR Evasion Framework
				https://klezvirus.github.io/RedTeaming/AV_Evasion/FromInjectionToHijacking/
				https://klezvirus.github.io/RedTeaming/AV_Evasion/CodeExeNewDotNet/
		https://github.com/alfarom256/PebLdr
		https://github.com/TheCruZ/Simple-Manual-Map-Injector
		http://www.rohitab.com/discuss/topic/40761-manual-dll-injection/
		* [Too Log; Didn't Read — Unknown Actor Using CLFS Log Files for Stealth - Adrien Bataille, Blaine Stancill(2021)](https://web.archive.org/web/20211001224021/https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html)
		https://github.com/Ahora57/MAJESTY-technologies
		https://github.com/hackerhouse-opensource/Marble
		https://mez0.cc/posts/malware-utilities/
		https://github.com/dodo-sec/Malware-Analysis/blob/main/Cobalt%20Strike/Indirect%20Syscalls.md
		https://github.com/accidentalrebel/RATwurst
			https://www.accidentalrebel.com/making-a-rat.html
		
		101
			https://www.installsetupconfig.com/win32programming/
			https://codemachine.com/articles/x64_deep_dive.html
			https://github.com/mytechnotalent/Hacking-Windows
			https://offensivecraft.wordpress.com/2023/02/11/the-stack-series-the-x64-stack/
			https://github.com/snowcra5h/windows-api-function-cheatsheets
			https://github.com/matthieu-hackwitharts/Win32_Offensive_Cheatsheet
			https://caiorss.github.io/C-Cpp-Notes/WindowsAPI-cpp.html#orge9d5c6d
			https://github.com/XaFF-XaFF/Assembler-MessageBox
			http://highscalability.com/blog/2023/2/22/consistent-hashing-algorithm.html
			https://learn.microsoft.com/en-us/windows/win32/winprog/windows-data-types
			https://github.com/HO-COOH/CPPDevOnWindows
			https://captmeelo.com//redteam/maldev/2022/05/10/ntcreateuserprocess.html
			https://steve-s.gitbook.io/0xtriboulet/making-malware/making-malware-0
				https://steve-s.gitbook.io/0xtriboulet/making-malware/making-malware-1
				https://steve-s.gitbook.io/0xtriboulet/making-malware/making-malware-2
			https://cocomelonc.github.io/tutorial/2021/09/15/simple-rev-c-1.html
			https://github.com/hacksysteam/msvc-wine
			https://cocomelonc.github.io/tutorial/2022/04/02/malware-injection-18.html
			https://cocomelonc.github.io/tutorial/2021/12/03/inline-asm-1.html
		General
			https://github.com/realoriginal/rogue
			https://codemachine.com/articles/x64_deep_dive.html
			replacement for waitforsingleobject - https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-waitonaddress
			https://www.youtube.com/watch?v=02fL2xpR7IM
			https://tbhaxor.com/dumping-token-information-in-windows/
			https://github.com/Chaoses-Ib/IbInputSimulator
			https://pre.empt.blog/
			https://research.checkpoint.com/2023/r2r-stomping-are-you-ready-to-run/
			https://github.com/RedSiege/SharpCollectionTemplate
			https://www.r-tec.net/r-tec-blog-net-assembly-obfuscation-for-memory-scanner-evasion.html
			https://github.com/Leandros/WindowsHModular
			https://github.com/DebugPrivilege/InsightEngineering/
			https://gitlab.com/ORCA000/kcthijacklib
			https://github.com/skeeto/w64devkit
			https://cocomelonc.github.io/malware/
			https://de-engineer.github.io/Understanding-Virtual-Memory-Paging-and-other-memory-related-concepts/
			https://github.com/vxunderground/VX-API
			https://techcommunity.microsoft.com/t5/windows-blog-archive/pushing-the-limits-of-windows-virtual-memory/ba-p/723750
			https://splintercod3.blogspot.com/p/a-very-simple-and-alternative-pid-finder.html
			https://tbhaxor.com/windows-process-listing-using-ntquerysysteminformation/
			https://github.com/adrianyy/x64-syscall
			https://tbhaxor.com/windows-process-listing-using-toolhelp32/
			https://wikileaks.org/ciav7p1/cms/page_14588809.html
			https://www.x86matthew.com/
			* [Quick & Lazy Malware Development - Capt Meelo(2021)](https://captmeelo.com/redteam/maldev/2021/12/15/lazy-maldev.html)
			https://captmeelo.com/redteam/maldev/2022/02/16/libraries-for-maldev.html
			https://captmeelo.com/redteam/maldev/2022/10/17/independent-malware.html
			https://github.com/je5442804/NtCreateUserProcess-Post
			https://github.com/reveng007/DarkWidow
			https://cocomelonc.github.io/pentest/2021/09/29/findmyprocess.html
			https://www.unknowncheats.me/forum/general-programming-and-reversing/319754-leak-eprocess-kprocess-usermode.html
			https://assume-breach.medium.com/home-grown-red-team-lets-make-some-malware-in-c-part-1-dc48fb360658
				https://assume-breach.medium.com/home-grown-red-team-from-workstation-to-domain-controller-with-havoc-c2-and-microsoft-edr-6b17018e32f6
				https://assume-breach.medium.com/home-grown-red-team-getting-system-on-windows-11-with-havoc-c2-cc4bb089d22
				https://github.com/assume-breach/Malware_Project
			https://www.youtube.com/watch?v=3TOiqGMCAOg
			https://github.com/Sqdwr/NtProcBase
			https://github.com/emc2314/YANSOllvm
			https://github.com/thebabush/dumb-obfuscator
			https://www.x86matthew.com/view_post?id=read_write_proc_memory
			https://www.x86matthew.com/view_post?id=call_remote_api
			https://www.x86matthew.com/view_post?id=hijack_file_handle
			https://www.usenix.org/legacy/event/woot07/tech/full_papers/daizovi/daizovi.pdf
			https://captmeelo.com/redteam/maldev/2022/10/17/independent-malware.html
			https://github.com/otya128/Load64bitDLL
			https://dazzyddos.github.io/posts/Remote-Process-Enumeration-with-WTS-Set-Of-APIs/
			https://docs.microsoft.com/en-us/windows/win32/toolhelp/taking-a-snapshot-and-viewing-processes
			https://www.accidentalrebel.com/string-av-evasion-in-x64-assembly-part-1.html
			https://github.com/capt-meelo/NtCreateUserProcess
			https://learn.microsoft.com/en-us/dotnet/framework/interop/specifying-an-entry-point#renaming-a-function-in-c-and-c
			https://www.trustedsec.com/events/video-series-building-your-ttp-arsenal-know-thy-self/			
			https://www.youtube.com/watch?app=desktop&v=v2jU8EsJMVc
				https://www.slideshare.net/AlexanderRymdekoHarv/rat-repurposing-adversarial-tradecraft
				https://github.com/killswitch-GUI/DeepFreeze-Agent
			https://redteamer.tips/basic-operational-security-when-dropping-to-disk/
			https://osandamalith.com/2016/01/02/hiding-data-inside-memory-addresses/
			https://github.com/rootkit-io/awesome-malware-development
			* [In Memory OPSEC - CodeX](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/loader-dev/in-memory-opsec)
			https://github.com/Octoberfest7/Mutants_Sessions_Self-Deletion
			https://snovvcrash.rocks/2023/02/14/pic-generation-for-threadless-injection.html
			https://www.slideshare.net/elvinguitar/developing-highimpact-malware-with-minimal-effortpptx
			https://pentest.blog/art-of-anti-detection-4-self-defense/
			https://techcommunity.microsoft.com/t5/ask-the-performance-team/application-compatibility-session-0-isolation/ba-p/372361
			https://z0mbie.dreamhosters.com/
			https://github.com/MalwareApiLib/MalwareApiLibrary
			https://github.com/Microwave89/createuserprocess
			https://github.com/aaaddress1/PR0CESS
			https://www.mdsec.co.uk/2022/08/fourteen-ways-to-read-the-pid-for-the-local-security-authority-subsystem-service-lsass/
			https://cocomelonc.github.io/book/2022/07/16/mybook.html
			https://www.accidentalrebel.com/converting-a-malware-dropper-to-x64-assembly.html
			https://captmeelo.com/redteam/maldev/2022/02/16/libraries-for-maldev.html
			https://github.com/tomLadder/WinLib/tree/master/WinLib/WinLib
			https://github.com/ScarredMonk/SysmonSimulator
			https://github.com/wirekang/mouseable
			https://csandker.io/2021/02/21/Offensive-Windows-IPC-2-RPC.html
			https://bit.ly/3Qg219P - Develop Your Own RAT
			https://phasetw0.com/windows-internals/optimizing_function_resolving/
				https://github.com/0x00Jeff/BetterGetProcAddress
			* [windows-dev-docs](https://github.com/MicrosoftDocs/windows-dev-docs)
			* [Offensive WinAPI](https://github.com/AvivShabtay/OffensiveWinAPI)
				* "Projects from my personal training in writing offensive code using the Windows API using C and C++."
			* [MalwareAdventurez](https://github.com/eversinc33/MalwareAdventurez)
			* [windows-playground](https://github.com/Inndy/windows-playground)
				* How to use Windows API 101
			* [x64 stack usage - learn.ms](https://learn.microsoft.com/en-us/cpp/build/stack-usage?view=msvc-160)
			* [Dynamic payload generation with mingw - @passthehashbrwn](https://passthehashbrowns.github.io/dynamic-payload-generation-with-mingw)
			* [Visual Studio documentation for Microsoft C++](https://github.com/MicrosoftDocs/cpp-docs)
			* [dbghelp.c - ReactOS](https://doxygen.reactos.org/d4/d73/dll_2win32_2dbghelp_2dbghelp_8c.html)
			* [The Definitive Guide To Process Cloning on Windows](https://github.com/huntandhackett/process-cloning)
				* This article aims to provide the reader with a comprehensive guide to the technical details and the underlying design decisions of process cloning on Windows and how they affect its usability. We will explore why most techniques for code injection via cloning will almost inevitably struggle with evading security products, yet other attack vectors like credential dumping might find their niche
			* [WinREPL](https://github.com/jeperez/WinREPL)
				* x86 and x64 assembly "read-eval-print loop" for Windows
			* [Public contributions for win32 API documentation - MS](https://github.com/MicrosoftDocs/sdk-api)
			* [Windows API sets - learn.ms](https://learn.microsoft.com/en-us/windows/win32/apiindex/windows-apisets)
				* "All versions of Windows share a common base of operating system (OS) components that's called the core OS (in some contexts this common base is also called OneCore). In core OS components, Win32 APIs are organized into functional groups called API sets.  The purpose of an API set is to provide an architectural separation from the host DLL in which a given Win32 API is implemented, and the functional contract to which the API belongs."
			* [A blueprint for evading industry leading endpoint protection in 2022 - Vincent Van Mieghem](https://vanmieghem.io/blueprint-for-evading-edr-in-2022/)
			* [Process injection in 2023, evading leading EDRs - Vincent Van Mieghem](https://vanmieghem.io/process-injection-evading-edr-in-2023/)
			* [Hackingz Ze Komputerz - Exploiting CAPCOM.SYS - Part 1 - OJ Reeves(2016)](https://www.youtube.com/watch?v=pJZjWXxUEl4)
				* Live stream of reverse engineering the "feature" provided by the capcom.sys driver on Windows using Binary Ninja and Windbg. Stream ends with development of a working exploit written in C that elevates privileges to SYSTEM.
			* [Hackingz Ze Komputerz - Exploiting CAPCOM.SYS - Part 2 - OJ Reeves(2016)](https://www.youtube.com/watch?v=UGWqq5kTiso)
				* This part shows the development of a Metasploit module that makes use of the exploit code written in Part 1. Includes the creation of the Pull Request to the Metasploit Github repository.
			* [Windows Sysmon Events correlated to WinAPI - OTRF](https://raw.githubusercontent.com/OTRF/API-To-Event/master/images/API-to-Sysmon.svg)
			* [About WriteProcessMemory - theevilbit(2018)](https://theevilbit.blogspot.com/2018/08/about-writeprocessmemory.html)
			https://www.irongeek.com/i.php?page=videos/derbycon9/3-17-improving-cactustorch-payloads-ryan-linn
			* [MalAPI.io](https://malapi.io/)
				* "MalAPI.io maps Windows APIs to common techniques used by malware."
			* [Moar and Moar Agents – sthap! - Hexacorn(2019)](https://www.hexacorn.com/blog/2019/07/27/moar-and-moar-agents-sthap/)
			* [Ownage From Userland: Process Puppeteering - Nick Cano(Derbycon2013)](https://www.irongeek.com/i.php?page=videos/derbycon3/1302-ownage-from-userland-process-puppeteering-nick-cano)
				* This offensive talk highlights a myriad of sneaky methods for manipulating processes on owned boxes. The talk will focus on tricks which can happily execute from userland and has a broad spectrum of applications which include ring-3 rootkit development, game hacking, virus development, and software augmentation.
			- Talks
				* [Writing Tiny, Efficient, And Reliable Malware - Rad Kawar(SteelCon2022)](https://www.youtube.com/watch?v=TfG9lBYCOq8)
					* Being able to develop reliable, stealthy and size efficient malware is something that has been necessary during our various offensive security engagements. In this talk we will go through how we systematically improved our offensive capabilities in order to successfully bypass and subvert industry leading EDR solutions. We will take you through the various steps we have taken in order to write smaller sized payloads, whilst maintaining stealth and reliability. This talk should help our audience design and start building more efficient payloads that can be used safely, with a very small chance of detection.
		Anti-Dbg
			https://github.com/helloobaby/AntiDebuggerDemo/stargazers
			https://github.com/helloobaby/heap-anti-debugger
			https://github.com/guided-hacking/anti-debugging
			https://github.com/revsic/AntiDebugging
			https://github.com/changeofpace/Self-Remapping-Code
			https://www.x86matthew.com/view_post?id=system_anti_debug
			* [Anti-Debugging](https://github.com/ThomasThelen/Anti-Debugging)
				* A collection of c++ programs that demonstrate common ways to detect the presence of an attached debugger.
			https://github.com/yo-yo-yo-jbo/anti_debugging_intro
			https://github.com/guided-hacking/anti-debugging
			https://github.com/tanc7/analyst-punish
			https://revers.engineering/patchguard-detection-of-hypervisor-based-instrospection-p2/
			https://momo5502.com/posts/2022-05-02-detecting-hypervisor-assisted-hooking/
			https://github.com/Hipepper/anti_all_in_one
			https://www.x86matthew.com/view_post?id=selfdebug
			* [TLS callbacks - Ilfak Guilfanov(2005)](https://hex-rays.com/blog/tls-callbacks/)
			* [Discover an AntiDebug feature: a newbie approach - s1ckb017(2022)](https://s1ckb017.github.io/2022/07/30/Discover-an-AntiDebug-feature-a-newbie-approach.html)
			* [VerySleepy](https://github.com/VerySleepy/verysleepy)
				* Very Sleepy, a sampling CPU profiler for Windows
			* [Baka](https://github.com/Ahora57/Baka)
				* Sample anti-debug with detect ScyllaHide/HyperHide and TitanHide
			* [AntiDebugging](https://github.com/FULLSHADE/AntiDebugging)
				* Anti-debugger and anti-reverse engineering techniques
		Anti-RE
			https://infosecwriteups.com/anti-reversing-techniques-part-2-bd5e0d3cd7aa
			https://github.com/JustasMasiulis/lazy_importer
		Anti-Sandbox
			https://shubakki.github.io/posts/2022/12/detecting-and-evading-sandboxing-through-time-based-evasion/
			Sandbox Evasion by Enumerating the Existence of Registry Keys - https://github.com/jsecu/7DaysofRed/blob/main/Day6.md
			https://github.com/lisandro-git/sandbox_evasion
			https://github.com/CheckPointSW/InviZzzible
			https://www.hexacorn.com/blog/2018/12/06/trivial-anti-blueteam-trick-for-32-bit-systems/
			https://blat-blatnik.github.io/computerBear/making-accurate-sleep-function/
			http://blog.redxorblue.com/2021/06/introducing-striker-and-payload.html
			https://www.botconf.eu/wp-content/uploads/2014/12/2014-2.7-Bypassing-Sandboxes-for-Fun.pdf
			* [Skrull](https://github.com/aaaddress1/Skrull)
				https://media.rootcon.org/ROOTCON%2015/Main%20Tracks/Skrull%20Like%20A%20King-%20From%20File%20Unlink%20to%20Persistence.pdf
			* [Sandbox_Scryer](https://github.com/PayloadSecurity/Sandbox_Scryer)
			* [Windows Anti-Emulation Tactics by abusing Non-Emulated API calls - jsecu](https://github.com/jsecu/7DaysofRed/blob/main/Day3.md)
			https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
			* [Malware sandbox evasion in x64 assembly by checking ram size Part 1 - Karlo L(2022)](https://www.accidentalrebel.com/malware-sandbox-evasion-in-x64-assembly-by-checking-ram-size-part-1.html)
			* [Trivial Anti-BlueTeam trick for 32-bit systems - hexacorn(2018)](https://www.hexacorn.com/blog/2018/12/06/trivial-anti-blueteam-trick-for-32-bit-systems/)
			* [SandboxProfiler](https://gitlab.com/brn1337/sandboxprofiler)
				 * Collect information of internet-connected sandboxes, no backend needed. This is achieved using telegram and interact.sh to collect data, however custom listeners are also supported. Non internet-connected sandboxes are not in scope, however it is possible to check for DNS exfiltration.
			* [Hacking Malware: Offense Is the New Defense - Valsmith, Quest(Defcon14)](https://www.youtube.com/watch?v=WEgxe85Pvc4&list=PL9fPq3eQfaaAxDI0xo83ZFzDAZgXO3Yhy&index=79)
		Anti-VM
			https://labs.nettitude.com/blog/vm-detection-tricks-part-3-hyper-v-raw-network-protocol/
			https://debugactiveprocess.medium.com/anti-vm-techniques-with-msacpi-thermalzonetemperature-32cfeecda802
				https://gist.github.com/teixeira0xfffff/36293713c254c69a7ba2353e8d64afce#file-msacpi_thermalzonetemperature-ps1
				https://unprotect.it/technique/thermal-zone-temperature/
			https://github.com/jonomango/nohv
			https://revers.engineering/evading-trivial-acpi-checks/
			https://github.com/void-stack/Hypervisor-Detection
			https://revers.engineering/detecting-hypervisor-presence-on-windows-10/
			https://secret.club/2020/01/12/battleye-hypervisor-detection.html
			https://github.com/bi-zone/rdtsc-checkvirt-poc
			https://github.com/helloobaby/Nmi-Callback
			https://labs.nettitude.com/blog/vm-detection-tricks-part-2-driver-thread-fingerprinting/
			https://labs.nettitude.com/blog/vm-detection-tricks-part-1-physical-memory-resource-maps/
			* [How anti-cheats detect system emulation -  Daax, iPower, ajkhoury, drew(2020)](https://secret.club/2020/04/13/how-anti-cheats-detect-system-emulation.html)
			* [Nmi-Callback](https://github.com/helloobaby/Nmi-Callback)
				* detect hypervisor with Nmi Callback
			* [CheckVM-Sandbox](https://github.com/nek0YanSu/CheckVM-Sandbox)
			* [Virtual Machine Detection In The Browser - bannedit(2019)](https://bannedit.github.io/Virtual-Machine-Detection-In-The-Browser.html)
		API Calls
			https://gist.github.com/dkrutsko/d6118638b0ef711b30bfcfe5b083d067
			https://github.com/pseuxide/ZwDetectMemoryRead
			* [CallObfuscator](https://github.com/d35ha/CallObfuscator)
				* Obfuscate specific windows apis with different apis
			https://www.huntress.com/blog/hackers-no-hashing-randomizing-api-hashes-to-evade-cobalt-strike-shellcode-detection
			https://stackoverflow.com/questions/940707/how-do-i-programmatically-get-the-version-of-a-dll-or-exe-file
			https://www.ired.team/offensive-security/defense-evasion/windows-api-hashing-in-malware
			https://docs.microsoft.com/en-us/windows/win32/apiindex/api-index-portal
			https://github.com/ORCx41/ApiHashing
			https://github.com/MalwareApiLib/MalwareApiLibrary
			https://github.com/helloobaby/hash_import
			https://github.com/rad9800/VehApiResolve
			https://www.0ffset.net/reverse-engineering/malware-analysis/dridex-veh-api-obfuscation/
			https://github.com/processhacker/phnt
			https://posts.specterops.io/understanding-the-function-call-stack-f08b5341efa4
		ASM
			https://github.com/sonictk/asm_tutorial
		BOFs
			* [Malware development part 8 - COFF injection and in-memory execution - 0xPat(2021)](https://0xpat.github.io/Malware_development_part_8/)
				* [COFFInjector](https://github.com/0xpat/COFFInjector)
		Build
			https://github.com/lordmulder/rich-header-eraser
			https://lucasg.github.io/2017/10/15/Api-set-resolution/
			https://github.com/forrest-orr/artifacts-kit
			https://blog.conan.io/2022/10/13/Different-flavors-Clang-compiler-Windows.html
			https://github.com/NetSPI/PESecurity
			https://github.com/njcve/inflate.py
			https://github.com/Fyyre/ntdll
			https://github.com/ytk2128/dll-merger
			https://github.com/mstorsjo/msvc-wine
			https://github.com/eeromutka/msvc_command_runner
			https://gist.github.com/aaaddress1/76f3ded4c72d1b095fe8084157f6a96a
			https://depthsecurity.com/blog/obfuscating-malicious-macro-enabled-word-docs
			https://www.solomonsklash.io/smaller-c-payloads-on-windows.html
			https://github.com/TomashuTTTT7/Hidecall
			https://github.com/lmapii/cproject
			https://blog.svgames.pl/article/cross-compiling-c-programs-for-ms-windows-using-mingw
			https://github.com/Mr-Un1k0d3r/AMSI-ETW-Patch
			https://github.com/mstorsjo/llvm-mingw
			https://github.com/AustinWise/delay-load-mingw
			https://malicious.link/post/2020/compiling-a-dll-using-mingw/
		NTDLL.dll
			* [NTLib](https://github.com/h4xu3lyn/NTLib)
				* Headers for linking your software with ntdll.dll
		Code Signing
			https://captmeelo.com/redteam/maldev/2022/11/07/cloning-signing.html
			https://github.com/kudelskisecurity/chainoffools
		Collection
			https://superkogito.github.io/blog/CaptureScreenUsingGdiplus.html
			https://xkln.net/blog/please-stop-using-win32product-to-find-installed-software-alternatives-inside/
		COM
			https://adapt-and-attack.com/category/payload-creation/
		Comms
			https://whiteknightlabs.com/2023/07/06/developing-winsock-communication-in-malware/
		Compression
			* [Shellcode: Base-N Decoding for Text-Only Compression and Obfuscation - modexp(2022)](https://modexp.wordpress.com/2022/08/22/base_n_compression/)
		Course/tutorial
			https://niiconsulting.com/checkmate/2018/02/malware-development-welcome-dark-side-part-1/
		Credential Attacks
			https://github.com/mobdk/WinBoost
			https://github.com/azazelm3dj3d/lsass-dump/tree/main
			https://s3cur3th1ssh1t.github.io/Reflective-Dump-Tools/
			* [minidump.c - ReactOs](https://doxygen.reactos.org/d8/d5d/minidump_8c_source.html)
		Crypto
			* [wincrypto](https://github.com/crappycrypto/wincrypto)
				* Windows Crypto API compatible decryption/encryption for python
			* [EncryptedKeyExchange](https://github.com/rasta-mouse/EncryptedKeyExchange)
				* "My attempt at implementing Encrypted Key Exchange in .NET between a web app and a client. I know nothing abut crypto or how this is supposed to work."
			https://www.cloudsavvyit.com/3274/how-to-create-a-self-signed-certificate-with-powershell/
			https://blog.gentilkiwi.com/tag/systemfunction032
			https://osandamalith.com/2022/11/10/encrypting-shellcode-using-systemfunction032-033/
			https://s3cur3th1ssh1t.github.io/SystemFunction032_Shellcode/
			https://www.0ffset.net/reverse-engineering/guloaders-stack-manipulation/
			https://gist.github.com/jackullrich/ce3b5263e05c88548b175f4f21909384
		Crypter
			https://medium.com/syscall59/a-trinity-of-shellcode-aes-go-f6cec854f992
		Data Access/Storage
			https://docs.microsoft.com/en-us/windows/win32/api/_fs/
			* [EncryptedStore](https://github.com/HarmJ0y/EncryptedStore)
				* Functions focued on storing data in single encrypted file for long term collection.
		Debug
			* [RemoteDebugView](https://github.com/hotnops/RemoteDebugView)
				* A DLL that serves OutputDebugString content over a TCP connection
		De-Obfuscation
			https://paper.bobylive.com/Meeting_Papers/BlackHat/Asia-2015/asia-15-Choi-API-Deobfuscator-Indentifying-Runtime-Obfuscated-API-Calls-Via-Memory-Access-Analysis.pdf
		Delivery
			* [Payload Factory](https://github.com/GeorgePatsias/PayloadFactory)
				* C# implementation of Shellcode delivery techniques using PInvoke and DInvoke variations for API calling.
			* [Hellsgate](https://github.com/JUICY00000/HellLoader)
				* Undetectable Loader for Cobalt Strike Using Syscalls And A External Shellcode
			* [Atomic Loader](https://github.com/cpueasy/atomic-loader)
				* "A Fully undetectable electron application exploit"
			* [Shhhloader](https://github.com/icyguider/Shhhloader)
				* "Shhhloader is a SysWhispers Shellcode Loader that is currently a Work in Progress. It takes raw shellcode as input and compiles a C++ stub that has been integrated with SysWhispers in order to bypass AV/EDR."
			* [charlotte](https://github.com/9emin1/charlotte)
			* [SeasideBishop](https://github.com/SolomonSklash/SeasideBishop)
				* A C port of b33f's UrbanBishop
			* [Ninja_UUID_Runner](https://github.com/boku7/Ninja_UUID_Runner)
				* Module Stomping, No New Thread, HellsGate syscaller, UUID Shellcode Runner for x64 Windows 10!
			* [Using ICMP to deliver shellcode -  Roman Rivas](https://blog.romanrii.com/using-icmp-to-deliver-shellcode)
		Desktops/Sessions
			* [CreateDesktop](https://github.com/MalwareTech/CreateDesktop/)
				* Example application for creating multiple desktops on Windows
		Dev Env
			https://github.com/skeeto/w64devkit	
		Discovery
			https://github.com/mitchmoser/LACheck
			https://github.com/TheTumultuousUnicornOfDarkness/CPU-X
			https://www.trustedsec.com/blog/creative-process-enumeration/
			https://github.com/DosX-dev/cpuid-in-C
			https://github.com/Bl4ckM1rror/PEAs
			https://github.com/ricardojoserf/WhoamiAlternatives
			https://github.com/sondernextdoor/WindowsHardwareInfo
		DLL
			https://mez0.cc/posts/exploring-dll-loads/
			https://github.com/pwnsauc3/RWXfinder
			https://blog.quarkslab.com/runtime-dll-name-resolution-apisetschema-part-i.html
			https://depthsecurity.com/blog/reflective-dll-injection-in-c
			https://github.com/MahmoudZohdy/DLL-Obfuscation-V2
			https://github.com/dismantl/ImprovedReflectiveDLLInjection
			* [MinGW-DLL-Example](https://github.com/TransmissionZero/MinGW-DLL-Example)
				* Example of how to create a DLL using MinGW, along with an application which uses that DLL.
			* [lazy_importer](https://github.com/JustasMasiulis/lazy_importer)
				* library for importing functions from dlls in a hidden, reverse engineer unfriendly way
			* [Dll2Shellcode](https://github.com/w1u0u1/Dll2Shellcode)
				* Convert native dll to shellcode, and support exported function
			https://medium.com/@1ndahous3/safe-code-pitfalls-dll-side-loading-winapi-and-c-73baaf48bdf5
		Drivers
			https://github.com/utoni/mingw-w64-dpp
			* [EFI Driver Access](https://github.com/TheCruZ/EFI_Driver_Access)
				* Efi Driver Access is a simply project to load a driver during system boot with the idea to give the user kernel access for read/write memory without restrictions 
		Evasion
			https://kwcsec.gitbook.io/the-red-team-handbook/techniques/defense-evasion/minimization/thread-less-payload-execution
			https://blogorama.nerdworks.in/selfdeletingexecutables/
			https://karma-x.io/blog/post/18/?=xachilles
			https://oldboy21.github.io/posts/2024/02/reflective-dll-got-indirect-syscall-skills/
			https://github.com/TomashuTTTT7/Hidecall
			https://dtsec.us/2023-11-04-ModuleStompin/
			https://github.com/knight0x07/PoC-Malware-TTPs
			https://github.com/WithSecureLabs/ModuleStomping
			https://balwurk.com/shellcode-evasion-using-webassembly-and-rust/
			https://github.com/naksyn/ModuleShifting
			https://s3cur3th1ssh1t.github.io/Cat_Mouse_or_Chess/
			https://github.com/senzee1984/MutationGate
			https://github.com/senzee1984/InflativeLoading
			https://github.com/florylsk/ExecIT
			https://github.com/comosedice2012/Introduction-to-Process-Hollowing
			https://github.com/fengjixuchui/Manual_Loader
			https://blog.bournemouth2600.org/2024/01/local-thread-hijacking.html
			https://naksyn.com/edr%20evasion/2023/11/18/mockingjay-revisited-process-stomping-srdi-beacon.html
			https://atos.net/en/lp/securitydive/using-edr-telemetry-for-offensive-research
			https://github.com/Xyrem/Yumekage
				https://reversing.info/posts/guardedregions/
			https://github.com/fengjixuchui/Veil
			https://signal-labs.com/windows-hotpatching-amp-process-injection/
				https://github.com/Signal-Labs/Hotpatching_PoC
			https://github.com/GeorgePatsias/PayloadFactory
			https://github.com/Cipher7/ChaiLdr
			https://fin3ss3g0d.net/index.php/2024/03/18/weaponizing-windows-thread-pool-apis-proxying-dll-loads/
			https://github.com/0prrr/Malwear-Sweet
			https://billdemirkapi.me/abusing-windows-implementation-of-fork-for-stealthy-memory-operations/
			https://mez0.cc/posts/vulpes-obfuscating-memory-regions/
			https://github.com/vvelitkn/Evasion-Escaper
			https://github.com/kleiton0x00/Proxy-DLL-Loads
			https://www.elastic.co/blog/edr-bypass-taxonomy
			https://github.com/baiyies/DamnPythonEvasion
			https://github.com/DragonQuestHero/antidetect
			https://github.com/garyexplains/oceantoo
			https://github.com/Kudaes/Fiber
			https://www.x86matthew.com/view_post?id=stealth_hook
			https://www.youtube.com/watch?v=TfG9lBYCOq8
			https://www.youtube.com/watch?v=PBDHhOtc0zM
				https://www.blackhat.com/us-21/briefings/schedule/#rope-bypassing-behavioral-detection-of-malware-with-distributed-rop-driven-execution-23051
			https://www.unknowncheats.me/forum/anti-cheat-bypass/286274-internal-detection-vectors-bypass.html
			https://github.com/ytk2128/pe32-password
			https://www.inversecos.com/2022/03/windows-event-log-evasion-via-native.html
			https://0xthem.blogspot.com/2014/10/self-delete-pe.html
			https://github.com/helloobaby/spoofcall
			https://github.com/susMdT/effective-waffle
			https://github.com/TheD1rkMtr/StackCrypt
			https://github.com/0xHossam/Killer
			https://github.com/lem0nSec/ShellGhost
			https://blog.malicious.group/writing-your-own-rdi-srdi-loader-using-c-and-asm/
			https://github.com/rmccrystal/modmap
			https://github.com/xuanxuan0/DripLoader
			https://steve-s.gitbook.io/0xtriboulet/ttps/ttps-badasm
			https://github.com/MrGameLeaks/Remove-your-systemthread-from-PspCidTable
			https://github.com/SecurityAndStuff/DllLoadPath
			https://secret.club/2023/06/05/spoof-pe-sections.html
			https://gist.github.com/alfarom256/fc8fab62103def18d467a25ebdad1ada
			https://github.com/elastic/protections-artifacts/blob/main/behavior/rules/defense_evasion_dll_dropped_by_msiexec_followed_by_sideload.toml
			https://0xstarlight.github.io/posts/Bypassing-Windows-Defender/
			https://fourcore.io/blogs/edr-detections-bypasses-and-other-shenanigans
			https://github.com/icyguider/LightsOut
			https://github.com/Hagrid29/herpaderply_hollowing
			https://medium.com/@Breadman602/breadman-module-stomping-api-unhooking-using-native-apis-b10df89cc0a2
			https://cocomelonc.github.io/tutorial/2021/09/04/simple-malware-av-evasion.html
			https://cocomelonc.github.io/tutorial/2021/09/06/simple-malware-av-evasion-2.html
			https://cocomelonc.github.io/tutorial/2021/12/25/simple-malware-av-evasion-3.html
			https://cocomelonc.github.io/tutorial/2022/03/18/simple-malware-av-evasion-4.html
			https://github.com/MahmoudZohdy/APICallProxy
			https://github.com/RoseSecurity/Anti-Virus-Evading-Payloads/blob/main/Bypass-AV-Payload-Detection.MD
			https://www.mdsec.co.uk/2022/07/part-1-how-i-met-your-beacon-overview/
			https://www.mdsec.co.uk/2022/07/part-2-how-i-met-your-beacon-cobalt-strike/
			https://github.com/Ahora57/Anti_suspend
			https://github.com/diversenok/Suspending-Techniques
			https://github.com/XaFF-XaFF/CaveCarver
			https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/
			https://github.com/ORCx41/GP
			https://rastamouse.me/building-a-slightly-better-melkor/
			https://www.youtube.com/watch?v=AT-9n6fF-OI
			https://github.com/gtworek/PSBits/tree/master/ProjFS
			https://github.com/mertdas/RedPersist/blob/main/RedPersist/Persist/autorun.cs
			https://medium.com/@matterpreter/hypervisor-detection-with-systemhypervisordetailinformation-26e44a57f80e
			https://github.com/hfiref0x/ZeroAccess/
			https://securityintelligence.com/x-force/reflective-call-stack-detections-evasions
			https://robertovitillo.com/what-every-developer-should-know-about-tcp/
			https://crypt0ace.github.io/posts/Staying-under-the-Radar/
			https://github.com/smallzhong/hide_execute_memory
			https://github.com/Ahora57/Anti_suspend
			https://github.com/sondernextdoor/Poseidon
			https://web.archive.org/web/20220505170100/https://suspicious.actor/2022/05/05/mdsec-nighthawk-study.html
			https://www.youtube.com/watch?app=desktop&v=JANjOgVXRMw
			https://ph3n1x.com/posts/offensive-tradecraft-night-walker/
			https://github.com/reveng007/DarkWidow
			https://pre.empt.dev/posts/maelstrom-static-review/
			https://github.com/D1rkMtr/FilelessNtdllReflection
			https://modexp.wordpress.com/2022/08/22/base_n_compression/
			https://ieeexplore.ieee.org/document/9186656
			https://www.r-tec.net/r-tec-blog-process-injection-avoiding-kernel-triggered-memory-scans.html
			https://research.nccgroup.com/2022/11/09/tales-of-windows-detection-opportunities-for-an-implant-framework/
			https://cocomelonc.github.io/tutorial/2022/03/22/simple-av-evasion-5.html
			https://cocomelonc.github.io/tutorial/2022/04/09/malware-av-evasion-6.html
			https://github.com/MaherAzzouzi/VMExploitation
			https://devblogs.microsoft.com/oldnewthing/20100827-00/?p=13023
			https://blog.xpnsec.com/undersanding-and-evading-get-injectedthread/
			https://github.com/gmh5225/FakeEnclave
			https://vimeo.com/502507556
			https://github.com/whokilleddb/etw-patching-for-dummies
			https://modexp.wordpress.com/2023/04/07/shellcode-entropy-reduction-with-base-n-encoding/
			https://www.unknowncheats.me/forum/anti-cheat-bypass/514047-fakeenclave.html
			https://github.com/D4stiny/ForkPlayground
			https://github.com/D1rkMtr/UnhookingPatch
			https://www.cyberark.com/resources/threat-research-blog/hook-heaps-and-live-free
			https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html
			https://github.com/kyleavery/TitanLdr/tree/heapencrypt
			https://secret.club/2023/06/05/spoof-pe-sections.html
			https://github.com/proxytype/Console-Process-Execution
			https://gist.github.com/susMdT/a10b35e3c06d8837d0260cdfc496c587
			https://github.com/KANKOSHEV/NoScreen
			https://jackson-t.ca/registry-data-persistence.html
			https://github.com/GetRektBoy724/SyscallShuffler
			https://x-c3ll.github.io/posts/windows-port-knocking/
			https://tishina.in/execution/phase-dive-sleep-obfuscation
			https://0xthem.blogspot.com/2014/10/self-delete-pe.html
			https://pre.empt.blog/
			https://github.com/zimnyaa/PhaseDive/
			https://github.com/wavestone-cdt/EDRSandblast/tree/DefCon30Release
			https://www.hexacorn.com/blog/2018/07/07/sysmon-doing-lines-part-4/
			https://medium.com/@fsx30/faking-your-return-address-through-gadget-and-rop-65cc6239599
			https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html
			https://github.com/trickster0/TartarusGate
			https://github.com/Cracked5pider/CodeCave/tree/main/EkkoEx
			https://github.com/Kudaes/Unwinder
			https://github.com/waldo-irc/YouMayPasser
			https://trickster0.github.io/posts/Halo%27s-Gate-Evolves-to-Tartarus-Gate/
			https://github.com/kyleavery/TitanLdr
			https://gist.github.com/SecIdiot/391b5a5a2d3dd83ed1c54cb4e218cf13
			* [Capcom Rootkit Proof-Of-Concept - b33f](http://www.fuzzysecurity.com/tutorials/28.html)
			General
				https://pre.empt.dev/posts/maelstrom-edr-kernel-callbacks-hooks-and-callstacks/
				https://github.com/whokilleddb/A-Study-in-Obfuscation
				https://redsiege.com/wp-content/uploads/2022/10/2022-WWHF-MIKE-SAUNDERS-ROLLFORSTEALH.pdf
				https://pre.empt.dev/posts/maelstrom-etw-amsi/
				* [A Dive on SMBEXEC - dmcxblue(2021)](https://dmcxblue.net/2021/02/20/a-dive-on-smbexec/)
			AMSI
				https://github.com/whokilleddb/amsi-patching-for-dummies
			API Hammering
				https://github.com/rad9800/BloatedHammer
				https://unit42.paloaltonetworks.com/api-hammering-malware-families/
			API Obfuscation & Resolution
				https://twitter.com/ollieatnowhere/status/1556184097709514753
				https://trikkss.github.io/posts/hiding_windows_api_calls_part1/
				https://github.com/embee-research/APIHashReplace
			BlockDLLs
				* [Protecting Your Malware with blockdlls and ACG - Adam Chester(2019)](https://blog.xpnsec.com/protecting-your-malware/)
				* [Preventing 3rd Party DLLs from Injecting into your Malware - @spotheplanet(2019)](https://www.ired.team/offensive-security/defense-evasion/preventing-3rd-party-dlls-from-injecting-into-your-processes)
				* [Doge-BlockDLLs](https://github.com/timwhitez/Doge-BlockDLLs)
				* [BlockDlls.b.cpp](https://github.com/vxunderground/VXUG-Papers/blob/main/BlockDlls.b.cpp)
			BlockHandles
				https://github.com/TheD1rkMtr/BlockOpenHandle
			Callstack
				https://fool.ish.wtf/2022/08/fixing-our-call-stack.html
				https://offensivecraft.wordpress.com/2022/12/08/the-stack-series-return-address-spoofing-on-x64/
				https://offensivecraft.wordpress.com/2022/11/29/memory-hiding-technique-series-ekko-the-basics/
				https://offensivecraft.wordpress.com/2022/11/28/memory-hiding-technique-series-part-0x1/
				https://klezvirus.github.io/RedTeaming/AV_Evasion/StackSpoofing/
				https://github.com/altoid29/SafeCall
				https://fool.ish.wtf/2022/08/fixing-our-call-stack.html
				https://www.youtube.com/watch?v=bSQau-PaCTE
				https://www.coresecurity.com/blog/hardware-call-stack
				https://www.cobaltstrike.com/blog/behind-the-mask-spoofing-call-stacks-dynamically-with-timers/
				- General
					* [x64 return address spoofing (source + explanation) - namazso](https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html)
					* [Spoofing Call Stacks To Confuse EDRs - William Burgess(2022)](https://labs.withsecure.com/publications/spoofing-call-stacks-to-confuse-edrs)
				- Tools
					* [SilentMoonwalk](https://github.com/klezVirus/SilentMoonwalk)
						* SilentMoonwalk is a PoC implementation of a true call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from control flow.
					* [CallStackSpoofer](https://github.com/WithSecureLabs/CallStackSpoofer)
						* A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)
					* [Unwinder](https://github.com/Kudaes/Unwinder/)
						* Unwinder is a PoC of how to parse PE's UNWIND_INFO structs in order to achieve "proper" thread stack spoofing from the point of view of the x64 calling convention.				
			DLL Load
				https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/
			DLL Unlinking
				https://blog.christophetd.fr/dll-unlinking/
			Driver Callbacks
				https://github.com/GetRektBoy724/DCMB
			ETW
				https://github.com/rad9800/misc/blob/main/NtTraceEvent.c
			ETWti
				https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/
			Function Resolution
				https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/beacon-object-files_dynamic-func-resolution.htm
			Function Stomping
				https://idov31.github.io/2022/01/28/function-stomping.html
					https://github.com/Idov31/FunctionStomping
			*-Gate
				Halo's Gate
					* [Halo's Gate - twin sister of Hell's Gate - reenz0h@Sektor7](https://blog.sektor7.net/#!res/2021/halosgate.md)
				Heavens gate
					https://github.com/bluesadi/Heavens-Gate
					https://github.com/dadas190/Heavens-Gate-2.0
					https://conference.hitb.org/hitbsecconf2021ams/materials/D1T2%20-%20Rebuilding%20Heavens%20Gate%20-%20ShengHao%20Ma.pdf
					http://www.rohitab.com/discuss/topic/44550-windows-x64-heavens-gate-syscall-not-going-through/
				Hell's gate
					https://github.com/TheKevinWang/HellsRunPE
					https://gitlab.com/Zer1t0/zsyscall
					https://github.com/florylsk/SignatureGate
					https://redops.at/en/blog/exploring-hells-gate
				Tartarus's Gate
					https://trickster0.github.io/posts/Halo%27s-Gate-Evolves-to-Tartarus-Gate/
						https://github.com/trickster0/TartarusGate
			General Obfuscation
				https://github.com/LloydLabs/shellcode-plain-sight
			GPU
				https://oxis.github.io/GPUSleep/
			Handle Abuse
				https://www.x86matthew.com/view_post?id=hijack_file_handle
				See Handle leaks for privesc
			Hooking
				https://cocomelonc.github.io/tutorial/2021/11/30/basic-hooking-1.html
			Hook-Avoidance
				https://github.com/rmusser01/NTDLLReflection
				https://github.com/sofneo/import-hoodini
				https://github.com/mansk1es/GhostFart
				https://github.com/NUL0x4C/KnownDllUnhook
			IAT
				https://xz.aliyun.com/t/12035
			Kernel/Instrumentation Callbacks
				https://github.com/Deputation/instrumentation_callbacks
				https://jsecurity101.medium.com/understanding-telemetry-kernel-callbacks-1a97cfcb8fb3
			Module Stomping
			PEB-related
				* [Hidden in PEB Sight: Hiding Windows API Imports With a Custom Loader - Christophe Tafani-Dereeper(2020)](https://blog.christophetd.fr/hiding-windows-api-imports-with-a-customer-loader/)
			PPID Spoofing
				https://captmeelo.com/redteam/maldev/2021/11/22/picky-ppid-spoofing.html
				https://mrd0x.com/introduction-to-parent-child-process-evasion/
			Process Ghosting
				https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack
				https://www.youtube.com/watch?v=OamW6-nu8PA
				https://github.com/IkerSaint/KingHamlet
				https://github.com/knightswd/ProcessGhosting
				https://pentestlaboratories.com/2021/12/08/process-ghosting/
				https://github.com/hasherezade/process_ghosting
				https://www.codereversing.com/blog/archives/65
				https://mobile.twitter.com/dez_/status/1404848823885762566
			Process Heap Encryption
				https://github.com/waldo-irc/LockdExeDemo
				* [Hook Heaps and Live Free - Arash Parsa(2021)](https://www.arashparsa.com/hook-heaps-and-live-free/)
				https://github.com/thefLink/DeepSleep/
				https://github.com/Kudaes/RustChain#compilation
				https://www.arashparsa.com/catching-a-malware-with-no-name/
				https://github.com/Cracked5pider/Ekko
				https://labs.withsecure.com/publications/bypassing-windows-defender-runtime-scanning
			Process Hollowing
				https://github.com/0x000050/ProcessHollowing
				https://github.com/0xsp-SRD/mortar
				https://0xsp.com/security%20research%20%20development%20srd/defeat-the-castle-bypass-av-advanced-xdr-solutions/
				* [TRunPE - Winternl](https://winternl.com/trunpe/)
				* [TRunPE](https://github.com/jackullrich/TRunPE)
					* A modified RunPE (process hollowing) technique avoiding the usage of SetThreadContext by appending a TLS section which calls the original entrypoint.
			Process Suspension
				https://github.com/0xv1n/proc-suspend
				https://www.trustedsec.com/blog/disabling-av-with-process-suspension/
			Reflective Loading
				DLL
					https://github.com/rapid7/ReflectiveDLLInjection
					https://github.com/Allevon412/ReflectiveDLLInjector
					https://blog.malicious.group/writing-your-own-rdi-srdi-loader-using-c-and-asm/
					* [ReflectiveDLLInjection](https://github.com/stephenfewer/ReflectiveDLLInjection)
						* Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process. As such the library is responsible for loading itself by implementing a minimal Portable Executable (PE) file loader. It can then govern, with minimal interaction with the host system and process, how it will load and interact with the host.
				PE
					https://blog.0x4.xyz/bypassing-windows-protection-mechanisms/keep-me-in-memory
			Ruy Lopez
				https://github.com/S3cur3Th1sSh1t/Ruy-Lopez
			Self-Delete
				https://github.com/proxytype/Explorer-Delete-Protection
			Sleep Evasion
				https://dtsec.us/2023-04-24-Sleep/
				https://idov31.github.io/2022/11/06/cronos-sleep-obfuscation.html
					https://github.com/Idov31/Cronos
				https://github.com/janoglezcampos/DeathSleep
				https://github.com/itaymigdal/GhostNap
			Skrull Technique
				https://www.youtube.com/watch?v=2VIXWO1CxdU
			Stack Spoofing
				https://steve-s.gitbook.io/0xtriboulet/ttps/ttps-jmpnocall
				https://www.youtube.com/watch?v=dl-AuN2xsbg
				https://docs.microsoft.com/en-us/cpp/cpp/exceptions-and-stack-unwinding-in-cpp?view=msvc-170
				https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/manually-walking-a-stack
				https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html
				https://github.com/mgeeky/ShellcodeFluctuation
				https://medium.com/@fsx30/faking-your-return-address-through-gadget-and-rop-65cc6239599
				https://docs.microsoft.com/en-us/cpp/build/exception-handling-x64?view=msvc-160
					https://twitter.com/namazso/status/1442313752767045635?s=21
				https://www.arashparsa.com/hook-heaps-and-live-free/
				* [SleepyCrypt](https://github.com/asaurusrex/SleepyCrypt)
				* [StackWalker](https://github.com/JochenKalmbach/StackWalker)
					* This article describes the (documented) way to walk a callstack for any thread (own, other and remote). It has an abstraction layer, so the calling app does not need to know the internals.
				* [DeepSleep](https://github.com/jfmaes/DeepSleep)
			Suspending Processes
				* [Suspending-Techniques](https://github.com/diversenok/Suspending-Techniques)
					* This is a repository that includes several tools for experimenting with various techniques for suspending processes on Windows. The idea of this project arose from a discussion at Process Hacker.			
			Syscalls
				https://github.com/EgeBalci/syscall_api
				https://github.com/ghostpepper108/Evasion/tree/main/syscall
				https://twitter.com/VirtualAllocEx/status/1660202826616778759
				https://github.com/Flawww/NtSyscaller
				https://github.com/passthehashbrowns/hiding-your-syscalls
				https://github.com/jthuraisamy/SysWhispers2
				https://passthehashbrowns.github.io/hiding-your-syscalls
				https://github.com/VirtualAlllocEx/DEFCON-31-Syscalls-Workshop/wiki
				https://labs.cognisys.group/posts/Combining-Indirect-Dynamic-Syscalls-and-API-Hashing/
				https://eversinc33.github.io/posts/avoiding-direct-syscall-instructions/
				https://labs.en1gma.co/malwaredevelopment/evasion/security/2023/08/14/syscalls.html
				https://github.com/n00bes/inline-syscall
				https://www.cyberwarfare.live/blog/vectored-syscall-poc
				https://d01a.github.io/syscalls/
				https://www.mdsec.co.uk/2022/04/resolving-system-service-numbers-using-the-exception-directory/
				https://github.com/x42en/sysplant
				https://raw.githubusercontent.com/eversinc33/Talks/main/Intro-to-Syscalls-for-Windows-Malware_Prelude_04-12-2023.pdf
				https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls
				https://cyberwarfare.live/bypassing-av-edr-hooks-via-vectored-syscall-poc/
				https://www.optiv.com/insights/source-zero/blog/sacrificing-suspended-processes
			Time Stomp
				https://www.kroll.com/en/insights/publications/cyber/anti-forensic-tactics/timestomping-with-newfiletime
			TxNTFS
				https://github.com/goldfix/Transactional-NTFS-TxF-.NET
				https://github.com/diversenok/TransactionMaster
					https://en.wikipedia.org/wiki/TxF
					https://habr.com/en/post/485788/
			VEH
				https://github.com/rad9800/hwbp4mw
				https://github.com/mike1k/HardwareBreakpoint
				https://saza.re/posts/exception_hijack/
				https://github.com/nccgroup/DetectWindowsCopyOnWriteForAPI/tree/master/d-dr-registers
				https://billdemirkapi.me/exception-oriented-programming-abusing-exceptions-for-code-execution-part-1/
				https://billdemirkapi.me/exception-oriented-programming-abusing-exceptions-for-code-execution-part-1/
			* **Zombify**
				* [Zombie Processes as a HIPS Bypass - Malwaretech(2014)](https://www.malwaretech.com/2014/12/zombie-processes-as-hips-bypass.html)
					* [ZombifyProcess](https://github.com/MalwareTech/ZombifyProcess)
					* create a standard Windows process in a suspended state, write our malicious code to the processes’ memory; the PEB and the EPROCESS structures will still be that of the original process, causing the HIPS to see the now malicious process as a legitimate signed executable (this is not RunPE or dynamic forking, because we don’t unmap the original executable and replacing it with our malicious one, as thos can be detected in multiple ways).
		Execution
			https://github.com/X-C3LL/memdlopen-lib
			https://www.x86matthew.com/view_post?id=windows_no_exec
			https://csandker.io/2019/07/24/ABeginnersGuideToWindowsShellcodeExecutionTechniques.html
			https://www.ired.team/offensive-security/defense-evasion/finding-all-rwx-protected-memory-regions
			https://www.x86matthew.com/view_post?id=shared_mem_utils
			https://github.com/csandker/inMemoryShellcode
			https://github.com/RtlDallas/Jomungand
			https://rixed-labs.medium.com/shellcode-execution-using-registerwaitforinputidle-291c82d2d3fd
			https://github.com/in0finite/EncryptedDllLoader
			https://atos.net/en/lp/securitydive/using-edr-telemetry-for-offensive-research
			https://www.binarydefense.com/resources/blog/threadsleeper-suspending-threads-via-gmer64-driver/
			https://github.com/ElliotKillick/LdrLockLiberator
			https://github.com/aaaddress1/PR0CESS
			https://github.com/SurgeGotTappedAgain/Pink-Eye
			https://www.x86matthew.com/view_post?id=windows_no_exec
			https://winslow1984.com/books/malware/page/reflectiveloading-and-inflativeloading
			https://github.com/RtlDallas/KrakenMask
			https://github.com/iilegacyyii/Shellcrypt
			https://github.com/Hagrid29/herpaderply_hollowing
			https://labs.nettitude.com/blog/creating-an-opsec-safe-loader-for-red-team-operations/
			https://github.com/OtterHacker/CoffLoader
			https://github.com/homjxi0e/LOLBAS222
			https://github.com/whokilleddb/exe_who
			https://github.com/jackullrich/TRunPE
			https://www.trustedsec.com/blog/object-overloading/
			https://github.com/NUL0x4C/NoRunPI
			https://labs.nettitude.com/blog/creating-an-opsec-safe-loader-for-red-team-operations/
				https://github.com/nettitude/Tartarus-TpAllocInject
			https://github.com/FiYHer/handle_grant_access
			https://github.com/thefLink/Memfiddler/blob/master/Memfiddler.cpp
			https://labs.jumpsec.com/abusing-shareduserdata-for-defense-evasion-and-exploitation-2/
			https://wikileaks.org/ciav7p1/cms/files/ICE-Spec-v3-final-SECRET.pdf
			https://github.com/Wra7h/FlavorTown
			https://www.x86matthew.com/view_post?id=windows_no_exec
			https://steve-s.gitbook.io/0xtriboulet/zerototal/zerototal-self-injecting-calc
			https://github.com/CognisysGroup/HadesLdr
				https://labs.cognisys.group/posts/Combining-Indirect-Dynamic-Syscalls-and-API-Hashing/
			https://github.com/Techryptic/Pokemon-Shellcode-Loader
			https://github.com/D4stiny/ExceptionOrientedProgramming
			https://bruteratel.com/research/feature-update/2021/01/30/OBJEXEC/
			https://github.com/thesecretclub/SandboxBootkit
			https://www.huntandhackett.com/blog/concealed-code-execution-techniques-and-detection
			https://dr4k0nia.github.io/posts/HInvoke-and-avoiding-PInvoke/
			https://github.com/NUL0x4C/APCLdr
			https://www.accidentalrebel.com/converting-a-malware-dropper-to-x64-assembly.html
			https://secret.club/2021/01/12/callout.html
			https://github.com/AchocolatechipPancake/FUD_x64_Loader
			https://github.com/enkomio/BrokenFlow
			https://www.netspi.com/blog/technical/adversary-simulation/srdi-shellcode-reflective-dll-injection/
			https://www.codeproject.com/Tips/430684/Loading-Win-DLLs-manually-without-LoadLibrary
			* [Hacking the World with HTML - Osanda Malith(2020)](https://osandamalith.com/2020/07/19/hacking-the-world-with-html/)
			* [PE2HTML](https://github.com/OsandaMalith/PE2HTML)
			COFF
				https://blog.sektor7.net/#!res/2022/cafebiba.md
				https://www.trustedsec.com/blog/operators-guide-to-the-meterpreter-bofloader/
				https://gist.github.com/freefirex/8b202c94fc6c1036aed1402a4dd28db1
			DLL
				https://github.com/tapika/dllloader
				https://github.com/SecurityAndStuff/DllLoadPath
				* [DLL Injection - Abraxus(2022)](https://kasimir123.github.io/blog-posts/DLL%20Injection.html)
					* "This post goes over how to perform a basic dll injection using LoadLibrary, it will then dive into how LoadLibrary works behind the scenes and go through the steps of manually mapping and injecting a DLL into a process."
			In-Memory
				https://www.youtube.com/watch?v=RJrxue6LnwE&t=1613s
				https://github.com/TheD1rkMtr/FilelessPELoader
				https://github.com/vic4key/QLoader
				https://github.com/arsium/PELoader
				https://wikileaks.org/ciav7p1/cms/files/ICE-Spec-v3-final-SECRET.pdf
				* [Reflective Polymorphism](https://github.com/zeroSteiner/reflective-polymorphism)
					* This project provides various utilities for the self-modification of PE images with the intention that they can be incorporated into external projects.
				* [Reflective PE Unloading - Spencer McIntyre(BSidesCleveland2018)](https://www.irongeek.com/i.php?page=videos/bsidescleveland2018/b00-reflective-pe-unloading-spencer-mcintyre)
					* Many in memory payload and implants utilize the tried and true technique pioneered by Stephen Fewer for "reflectively" loading a PR file into memory. This technique is fantastic and allows tools to take a blob in memory and load it as if it were a PE file existing on disk. What will be outlined in this talk is a technique to reverse this process and go from having an image loaded in memory to having a PE blob in memory suitable for writing to disk. This creates an exact byte for byte copy of an image suitable for being loaded back into memory (either reflectively or through the Windows system loader) and repeating the process. This could be used, for example to have a payload which is running in memory copy itself out and write itself to an arbitrary location for persistence without having to download a fresh copy from the network or keep an original in memory. The talk will focus on the technical challenges that were present while developing the technique, and provide a description of the differences of a PE file as it exists on disk and loaded in memory. Proof of concept code for the the x86 and x86-64 architectures will be released and demonstrated.
			Packaging
				https://jrsoftware.org/isinfo.php
			Shellcode
				https://github.com/rainerzufalldererste/windows_x64_shellcode_template
				https://blog.didierstevens.com/programs/shellcode/
				https://github.com/kymb0/Stealth_shellcode_runners
				https://github.com/Mr-Un1k0d3r/Shellcoding
				https://github.com/enkomio/BrokenFlow
				https://marcoramilli.com/2022/06/15/running-shellcode-through-windows-callbacks/
				https://github.com/boku7/x64win-DynamicNoNull-WinExec-PopCalc-Shellcode
			Syscalls
				https://github.com/0xcpu/WinAltSyscallHandler
				https://www.youtube.com/watch?v=bZw_DD6m1q0
				https://github.com/rad9800/hwbp4mw/blob/main/TamperingSyscalls2.c
				https://0xdarkvortex.dev/hiding-in-plainsight/
				https://github.com/amitwaisel/Malproxy
				https://github.com/Bw3ll/ShellWasp
				https://github.com/evilashz/ProxyAPICall
				https://eversinc33.github.io/posts/avoiding-direct-syscall-instructions/
				https://github.com/Dec0ne/HWSyscalls
				https://github.com/JustasMasiulis/inline_syscall
			VEH
				https://billdemirkapi.me/exception-oriented-programming-abusing-exceptions-for-code-execution-part-1/
					https://billdemirkapi.me/abusing-exceptions-for-code-execution-part-2/
			Windows loader
				https://www.youtube.com/watch?v=8_kfyKVk32c
		Execution of Shellcode
			https://github.com/Bl4ckM1rror/FUD-UUID-Shellcode
			https://github.com/FULLSHADE/Jektor
			https://github.com/DamonMohammadbagher/NativePayload_CBT
			https://github.com/snowcra5h/win32-shellcode
			* [AlternativeShellcodeExec](https://github.com/S4R1N/AlternativeShellcodeExec)
				* Alternative Shellcode Execution Via Callbacks
		Firewall
			* [winfirewall](https://github.com/getlantern/winfirewall)
				* Control the Windows Firewall from Go, supports Windows XP API and Advanced Security COM API
			* [WindowsFirewallHelper](https://github.com/falahati/WindowsFirewallHelper)
				* A class library to manage the Windows Firewall as well as adding your program to the Windows Firewall Exception list. 
		`*`-Gate
			* [AsmHalosGate](https://github.com/boku7/AsmHalosGate)
				* x64 Assembly HalosGate direct System Caller to evade EDR UserLand hooks
		Gadgets
			https://www.syssec.ruhr-uni-bochum.de/media/emma/veroeffentlichungen/2021/08/16/GadgetSynthesis-ESORICS21.pdf
			* [SGC: Towards Automating Code-Reuse Attacks Using Synthesized Gadget Chains](https://github.com/RUB-SysSec/gadget_synthesis)
				* "SGC is a tool to automatically synthesize gadget chains. It builds a logical formula to encode execution state at the time when the attacker can divert execution flow to the gadget chain as well as the attacker’s desired program state that the gadget chain should construct. By extracting and then logically encoding gadgets, we query an SMT solver to decide whether a valid gadget chain exists."
			* [Ropper](https://github.com/sashs/Ropper)
				* You can use ropper to display information about binary files in different file formats and you can search for gadgets to build rop chains for different architectures (x86/X86_64, ARM/ARM64, MIPS/MIPS64, PowerPC/PowerPC64, SPARC64).
			* [rp++](https://github.com/0vercl0k/rp)
				* rp++ is a full-cpp written tool that aims to find ROP sequences in PE/Elf/Mach-O x86/x64 binaries.
		General
			https://twitter.com/NinjaParanoid/status/1436753991484854277
		GPU Poisoning
			https://gitlab.com/ORCA000/gp
		GUI
			* [kolor](https://github.com/profdrac/kolor)
				* "A GUI framework in Assembly-Language (Masm32) for creating custom GUI for Keygens/Patchers. Though thats not a requirement, it can be used on any app being coded using masm32."
		Handles
			Duplicating
				https://rastamouse.me/duplicating-handles-in-csharp/
		Heap Encryption
			https://www.arashparsa.com/hook-heaps-and-live-free/
		Hidden Desktops
			https://github.com/Meltedd/HVNC
			https://github.com/x1234xx/HVNC-BOT-2021
			https://github.com/x1234xx/HVNC-Stealer
			* [Hidden VNC for Beginners - MalwareTech(2015)](https://www.malwaretech.com/2015/09/hidden-vnc-for-beginners.html)
			* [CreateDesktop](https://github.com/MalwareTech/CreateDesktop/)
				* Example application for creating multiple desktops on Windows
		Hooking
			https://github.com/trickster0/LdrLoadDll-Unhooking
			https://github.com/GetRektBoy724/HalosUnhooker
			https://github.com/BeneficialCode/DectectHook
			https://signal-labs.com/analysis-of-edr-hooks-bypasses-amp-our-rust-sample/
			https://github.com/mansk1es/GhostFart
			https://github.com/nelfo/PGHooker
			https://rioasmara.com/2022/02/28/process-unhooking-by-reading-ntdll-dll-fresh-copy/
			https://www.pikered.com/en/learn/how-does-zaiux-evade-edrs-part-1/
			* [Hooks-On Hoot-Off: Vitaminizing MiniDump - Adepts of 0xCC](https://adepts.of0x.cc/hookson-hootoff/)
			* [Full DLL Unhooking with C++ - @spotheplanet](https://www.ired.team/offensive-security/defense-evasion/how-to-unhook-a-dll-using-c++)
			* [API Monitoring and Hooking for Offensive Tooling - @spotheplanet](https://www.ired.team/offensive-security/code-injection-process-injection/api-monitoring-and-hooking-for-offensive-tooling)
		IAT
			https://alice.climent-pommeret.red/posts/how-and-why-to-unhook-the-import-address-table/
			https://devblogs.microsoft.com/oldnewthing/20221006-07/?p=107257
			https://github.com/MahmoudZohdy/IAT-Obfuscation
			https://wambui-ngige.medium.com/dynamic-analysis-of-windows-exploit-mitigations-import-address-filtering-16fc28029529
		ImpHash
			https://www.scythe.io/library/breaking-imphash
			https://arxiv.org/ftp/arxiv/papers/1909/1909.07630.pdf
			* [Defeating Imphash - Tim Malcomvetter(2019)](https://malcomvetter.medium.com/defeating-imphash-fb7cf0183ac)
		Process Injection
			* [DInjector](https://github.com/snovvcrash/DInjector)
				* Collection of shellcode injection techniques packed in a D/Invoke weaponized DLL
			https://modexp.wordpress.com/2018/07/12/process-injection-writing-payload/
			https://www.riskinsight-wavestone.com/en/2023/10/process-injection-using-ntsetinformationprocess/
			https://rastamouse.me/exploring-process-injection-opsec-part-1/
			https://github.com/can1357/ThePerfectInjector
			https://github.com/b4rth0v5k1/EarlyBirdNTDLL
			https://github.com/Kudaes/EPI
			https://github.com/Bl4ckM1rror/ZombieThread
			https://vanmieghem.io/process-injection-evading-edr-in-2023/
			https://github.com/whokilleddb/injection-for-dummies
			https://github.com/rvrsh3ll/RuralBishop
			https://bohops.com/2023/06/09/no-alloc-no-problem-leveraging-program-entry-points-for-process-injection/
			https://www.youtube.com/watch?app=desktop&v=bmpQfM3pDvs
			https://github.com/aaaddress1/knownDlls_Poison
			https://vanmieghem.io/process-injection-evading-edr-in-2023/
			Remote Process Injection via NtCreateThreadEx - https://github.com/jsecu/7DaysofRed/blob/main/Day5.md
			Go
				https://www.symbolcrash.com/podcast/
				https://www.symbolcrash.com/podcast/golang-offensive-tools-with-c-sto-and-capnspacehook/
				https://www.symbolcrash.com/podcast/interview-with-josh-pitts/
		IPC
			General
				https://github.com/csandker/InterProcessCommunication-Samples
				https://kwcsec.gitbook.io/the-red-team-handbook/techniques/defense-evasion/ipc-for-sandbox-evasion-and-organization
				https://github.com/csandker/InterProcessCommunication-Samples
				https://github.com/csandker/InterProcessCommunication-Samples
			ALPC
				https://csandker.io/2022/05/24/Offensive-Windows-IPC-3-ALPC.html
			ETHREAD
				* [Stealthy Process Communication Between Threads on Windows 10 - lloydlabs(2021)](https://blog.syscall.party/post/windows-10-stealthy-threads/)
				* [dearg-thread-ipc-stealth](https://github.com/LloydLabs/dearg-thread-ipc-stealth)
					* A novel technique to communicate between threads using the standard ETHREAD structure
			Event Objects
				https://www.x86matthew.com/view_post?id=eventpipe
			MailSlots
				https://docs.microsoft.com/en-us/windows/win32/ipc/mailslots
				https://docs.microsoft.com/en-us/windows/win32/ipc/creating-a-mailslot
			Named Pipes
				https://csandker.io/2021/01/10/Offensive-Windows-IPC-1-NamedPipes.html
			RPC
				https://csandker.io/2021/02/21/Offensive-Windows-IPC-2-RPC.html
		Kernel
			https://github.com/bfuzzy1/TransitionalPeriod
			https://github.com/9176324/Shark
			https://github.com/waleedassar/RestrictedKernelLeaks
			https://github.com/jxy-s/stlkrn
			https://blog.f-secure.com/analyzing-the-doublepulsar-kernel-dll-injection-technique/
			https://github.com/DownWithUp/DynamicKernelShellcode
			https://github.com/IgorKorkin/MemoryRanger
			https://github.com/waryas/EUPMAccess
			https://github.com/Cr4sh/KernelForge
			https://github.com/MiroKaku/ucxxrt
			https://m0uk4.gitbook.io/notebooks/mouka/windowsinternal/find-kernel-module-address-todo
			https://m0uk4.gitbook.io/notebooks/mouka/windowsinternal/patch-guard-oops
			https://github.com/TygoL/kdmapper-mdl
			https://github.com/Zer0Mem0ry/KernelBhop
			https://github.com/paradoxwastaken/Poseidon
			https://github.com/TheCruZ/kdmapper
			https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/sending-commands-from-userland-to-your-kernel-driver-using-ioctl
			* [NtLua](https://github.com/can1357/NtLua)
				* Lua in kernel-mode because why not.
			* [IBM RedCON 2020: Throwing an AquaWrench into the Kernel ⚡💀](https://github.com/FuzzySecurity/IBM-RedCON-2020)
				* AquaWrench bridges the gap between Administrator and Kernel access. It is a modular plug-and-play framework built around vulnerable signed drivers that allow the user to map and unmap physical memory. Through this exploitation primitive AquaWrench has the ability to perform arbitrary Kernel reads and writes.			
			Network Comms
				https://github.com/MiroKaku/libwsk
			Shellcode
				https://zerosum0x0.blogspot.com/2017/04/doublepulsar-initial-smb-backdoor-ring.html
				https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/interrupt-descriptor-table-idt
				https://improsec.com/tech-blog/windows-kernel-shellcode-on-windows-10-part-1
				https://media.blackhat.com/bh-us-12/Briefings/Cerrudo/BH_US_12_Cerrudo_Windows_Kernel_WP.pdf
				* [DKOM – Now with Symbolic Links!](https://windows-internals.com/dkom-now-with-symbolic-links/)
				* [Symbolic Hooks Part 2 : Getting the Target Name](https://windows-internals.com/symhooks-part-two/)
				* [Symbolic Hooks Part 3: The Remainder Theorem](https://windows-internals.com/symhooks-part-three/)
				* [Symbolic Hooks Part 4: The App Container Traverse-ty](https://windows-internals.com/symhooks-part-four/)
				https://labs.jumpsec.com/defending-your-malware/
		Keying
			https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf
			https://mez0.cc/posts/when-environmental-keying-meets-dpapi/
			https://mez0.cc/posts/greta-windows-crypto-environmental-keys/
		Keylogger
			https://github.com/briancollins/keylogger-rs
		Lateral Movement
			WMI
				https://github.com/RiccardoAncarani/LiquidSnake
		LLVM
			https://github.com/NewWorldComingSoon/llvm-msvc
		Loader
			C#
				https://github.com/VoldeSec/PatchlessCLRLoader
		Memory
			https://github.com/DarthTon/Blackbone
			https://github.com/CvX/hadesmem
			https://github.com/nccgroup/mnemosyne
			https://github.com/0vercl0k/sic
			https://mez0.cc/posts/vulpes-obfuscating-memory-regions/
			https://www.trustedsec.com/blog/windows-processes-nefarious-anomalies-and-you-memory-regions/
			https://github.com/waryas/UMPMLib
			https://github.com/twelvesec/panicbutton
			* [DMA Abuses and In-Memory Malware Detection - Ulf Frisk(HelSec Virtual meetup #5)](https://www.youtube.com/watch?v=FJlJpYZkcec)
				* "PCILeech has become the defacto standard for PCIe DMA attacks amongst researchers, red teamers, governments and game cheaters alike. Hyper-V host-to-guest is now supported as well. I will demo how to inject and execute code in the kernel; live edit memory with IDA and much more. MemProcFS is memory forensics made super easy! Analyze memory dumps or live memory by clicking on files in a virtual file system using your favorite tools. Find injected malware in seconds, recover files or take a peek at process internals. MemProcFS is 100% open source memory forensics, blazingly fast and super easy to use!"
		Module Overloading
			https://github.com/hasherezade/module_overloading
		Mutexes
			https://www.hexacorn.com/blog/2023/03/12/list-of-clean-mutexes-and-mutants/
			* [Polymorphic Mutex Names - odzhan(2017)](https://modexp.wordpress.com/2017/10/30/poly-mutex-names/)
			https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html
		.NET CLR
			https://mez0.cc/posts/common-language-runtime-1/
			https://mez0.cc/posts/common-language-runtime-2/
			https://mez0.cc/posts/common-language-runtime-3/
		Named Pipes
			https://csandker.io/2021/01/10/Offensive-Windows-IPC-1-NamedPipes.html
			Lateral Movement with Named Pipes - https://github.com/jsecu/7DaysofRed/blob/main/Day4.md
		Network
			https://github.com/chokepoint/CryptHook
			https://learn.microsoft.com/en-us/windows/win32/api/windns/nf-windns-dnsextractrecordsfrommessage_w
			https://x-c3ll.github.io/posts/windows-port-knocking/
			https://github.com/codewhitesec/Lastenzug
			https://www.shelliscoming.com/2018/06/windows-reuse-shellcode-based-on.html
			https://www.shelliscoming.com/2019/03/one-way-shellcode-for-firewall-evasion.html
			https://www.shelliscoming.com/2019/11/retro-shellcoding-for-current-threats.html
			https://adepts.of0x.cc/connectionless-shells/
			https://learn.microsoft.com/en-us/windows/win32/wininet/wininet-vs-winhttp
			https://github.com/Arno0x/DivertTCPconn
			* [A Meterpreter and Windows proxy case - Juan Caillava(2017)](https://medium.com/@br4nsh/a-meterpreter-and-windows-proxy-case-4af2b866f4a1)
			* [Adding a native sniffer to your implants: decomposing and recomposing PktMon - Adepts of 0xCC](https://adepts.of0x.cc/pktmon-dissection/#eof)
			* [PortBender](https://github.com/praetorian-inc/PortBender)
				*  TCP Port Redirection Utility
			* [StreamDivert](https://github.com/jellever/StreamDivert)
				* [StreamDivert: Relaying (specific) network connections - Jelle Vergeer(2020)](https://research.nccgroup.com/2020/09/10/streamdivert-relaying-specific-network-connections/)
				* Redirecting (specific) TCP, UDP and ICMP traffic to another destination.
			* [Proxy-Aware Payload Testing - redxorblue](https://blog.redxorblue.com/2019/09/proxy-aware-payload-testing.html)
    			* "I get told that I am too wordy, so if you want the summary, here are some steps to setup a virtual testing environment to test payloads to see if they can handle HTTP(S) proxies and if so, can they authenticate properly through them as well. This post will cover the proxy setup without authentication since that is the easier part, and I will do a second post shortly to hack together the authentication portion of it."		
		Obfuscation
			https://nimrodpar.github.io/posts/firmup-paper/
			* [NSGenCS](https://github.com/t3hbb/NSGenCS)
				* Extendable payload obfuscation and delivery framework			
			* [Obfvious](https://github.com/nimrodpar/Obfvious)
				* Obfvious is a LLVM & Clang (version 12) based compiler that allows for Windows binaries obfuscation.
			https://github.com/mike1k/perses
			https://github.com/weak1337/Alcatraz
			https://github.com/PaulNorman01/Dynamizer
			https://github.com/frank2/blenny
			https://modexp.wordpress.com/2022/08/22/base_n_compression/
			https://modexp.wordpress.com/2022/07/31/shellcode-data-masking/
			https://github.com/guillaC/BatchObfuscator
			https://github.com/SwenenzY/section-obfuscation
			https://github.com/TheComet/polymorhpic-crypter
			https://github.com/MahmoudZohdy/IAT-Obfuscation
			https://github.com/frkngksl/Shoggoth
			https://github.com/nlog2n/x86obfuscator
			https://github.com/martinvelez/w32evol
			https://github.com/TheD1rkMtr/PE-Obfuscator
			https://github.com/nelfo/Milfuscator
			https://www.ndss-symposium.org/wp-content/uploads/2018/07/bar2018_11_Kotov_paper.pdf
			https://www.scribd.com/document/239041021/a-museum-of-api-obfuscation-on-win32
			https://securityintelligence.com/protected-api-calls-and-string-constants-looting-dridexs-candy-box/
			https://vxug.fakedoma.in/archive/Symantec/security-response-museum-API-win32-09-en.pdf
		Packers
			https://github.com/jeremybeaume/packer-tutorial
			https://github.com/phra/PEzor
			https://github.com/KooroshRZ/Evader
			https://github.com/YuriSizuku/SimpleDpack
			https://github.com/nickcano/RelocBonus
			https://github.com/frank2/packer-tutorial
			https://www.youtube.com/watch?v=7L8r6kN_RT8
				https://github.com/frank2/packer-tutorial
			https://github.com/93aef0ce4dd141ece6f5/Packer
			* [Windows-PE-Packer](https://github.com/czs108/Windows-PE-Packer)
				* A packer for Windows x86 executable files written in C and Intel x86 Assembly. The new file after packing can obstruct reverse engineering.
		PageTables
			https://github.com/Rythorndoran/PageTableHook
		Payloads
			* **HTA** 
				* [genHTA](https://github.com/vysec/GenHTA)
					* Generates anti-sandbox analysis HTA files without payloads
				* [morpHTA](https://github.com/vysec/MorphHTA)
					* Morphing Cobalt Strike's evil.HTA 
				* [Demiguise](https://github.com/nccgroup/demiguise)
					* The aim of this project is to generate .html files that contain an encrypted HTA file. The idea is that when your target visits the page, the key is fetched and the HTA is decrypted dynamically within the browser and pushed directly to the user. This is an evasion technique to get round content / file-type inspection implemented by some security-appliances. This tool is not designed to create awesome HTA content. There are many other tools/techniques that can help you with that. What it might help you with is getting your HTA into an environment in the first place, and (if you use environmental keying) to avoid it being sandboxed.
			* **LNK Files**
				* [LNKUp](https://github.com/Plazmaz/LNKUp)
					* Generates malicious LNK file payloads for data exfiltration
				* [Embedding reverse shell in .lnk file or Old horse attacks](http://onready.me/old_horse_attacks.html)
			* **MSI Binaries**
				* [Wix Toolkit](http://wixtoolset.org/)
					* Tool for crafting msi binaries
				* [Distribution of malicious JAR appended to MSI files signed by third parties](https://blog.virustotal.com/2019/01/distribution-of-malicious-jar-appended.html)
			* **SCT Files**
				* [SCT-obfuscator](https://github.com/Mr-Un1k0d3r/SCT-obfuscator)
					* SCT payload obfuscator. Rename variables and change harcoded char value to random one.
		PDFs
			https://www.youtube.com/watch?v=mJZCNqcO10A&list=PLruly0ngXhPG6GPFSft4FyEuTEh2P8WdQ&index=4
		PEs
			https://www.solomonsklash.io/devils-in-the-details.html
			http://ropgadget.com/posts/richheader_hunting.html
			https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/
			https://github.com/RichHeaderResearch/RichPE
			* [Windows PEB parsing – A binary with no imports - bidouillesecurity(2021)](https://bidouillesecurity.com/windows-peb-parsing-a-binary-with-no-imports/)
				* "We’re going to see how a program can parse the PEB to recover Kernel32.dll address, and then load any other library. Not a single import is needed !"
			https://learn.microsoft.com/en-us/windows/win32/debug/pe-format
			https://github.com/co3moz/pe-coff-viewer
			https://github.com/hfiref0x/AuthHashCalc
			https://0xrick.github.io/win-internals/pe5/
			https://www.youtube.com/watch?v=uoQL3CE24ls
			https://www.youtube.com/watch?v=oswbh4UnJFE
			https://github.com/xoreaxecx/PEmimic
			https://mohamed-fakroud.gitbook.io/red-teamings-dojo/shellcoding/leveraging-from-pe-parsing-technique-to-write-x86-shellcode
			https://github.com/obscuritylabs/PeFixup
			https://blog.sunggwanchoi.com/creating-a-loader-poc-using-various-languages/
			https://github.com/hfiref0x/AuthHashCalc
			https://github.com/LethalSnake1337/PE-Loader-exercise
			https://github.com/y11en/PEBFake
			https://github.com/lordmulder/rich-header-eraser
			https://github.com/serge1/COFFI
			https://github.com/secana/PeNet
			https://github.com/fr0gger/unprotect
			https://web.archive.org/web/20151021153248/http://www.ragestorm.net/blogs/?p=5
			https://github.com/merces/pev
			https://0xdarkvortex.dev/red-team-ttps-part-2-push-0xpe-call-0xloader/
			https://0xboku.com/2019/11/05/Win32-GetProcAddress.html
		PE Imports/Exports
			https://github.com/redplait/pexphide
			https://github.com/mike1k/VMPImportFixer
			https://github.com/mike1k/ImportCallObfuscator
			https://github.com/cihansol/PEExportGen
		PE Loaders
			PE Loader
				https://github.com/aaaddress1/RunPE-In-Memory
				https://www.youtube.com/watch?v=oswbh4UnJFE
				https://github.com/TheD1rkMtr/FilelessPELoader
				https://github.com/NUL0x4C/ToasterLoader
			DLL Loader
				https://www.youtube.com/watch?v=jg0CmrwEcNs
			https://www.youtube.com/watch?v=jg0CmrwEcNs
			* [nloader](https://github.com/sherpya/nloader)
				* Native win32 executables loader
			https://github.com/biesigrr/pe-loader
			https://speakerdeck.com/lillypad/pe-file-structure-security-and-custom-base-64-steganography
			https://github.com/VLiance/ExeLoader
			https://github.com/Bubb13/InfinityLoader
			https://github.com/LethalSnake1337/PE-Loader-exercise
			https://labs.nettitude.com/blog/introducing-process-hiving-runpe/
			https://www.joachim-bauch.de/tutorials/loading-a-dll-from-memory/
			https://www.scythe.io/library/loading-capabilities-from-memory-open-sourcing-scythes-windows-c-in-memory-module-loader
			https://0xdarkvortex.dev/index.php/2020/10/08/red-team-ttps-part-2-push-0xpe-call-0xloader/
			* [DoublePulsarPayload](https://github.com/oXis/DoublePulsarPayload)
				* C++ implementation of DOUBLEPULSAR usermode shellcode. Yet another Reflective DLL loader.
			* [PIC-Get-Privileges](https://github.com/paranoidninja/PIC-Get-Privileges)
				* Building and Executing Position Independent Shellcode from Object Files in Memory
			* [DarkLoadLibrary](https://github.com/bats3c/DarkLoadLibrary)
				* LoadLibrary for offensive operations
			* [COFFInjector](https://github.com/0xpat/COFFInjector)
				* PoC MSVC COFF Object file loader/injector.
			* [pe-loader](https://github.com/polycone/pe-loader)
				* A Windows PE format file loader
			* [mmLoader](https://tishion.github.io/mmLoader/)
				* A library for loading dll module bypassing windows PE loader from memory (x86/x64)
			* [dynobj](https://github.com/lieff/dynobj)
				* Dynamic COFF object loader
			* [MemoryModulePP](https://github.com/bb107/MemoryModulePP)
				* MemoryModule which compatible with Win32 API and support exception handling
			* [memory-module-loader](https://github.com/scythe-io/memory-module-loader)
				* An implementation of a Windows loader that can load dynamic-linked libraries (DLLs) directly from memory
			* [MemoryModule](https://github.com/fancycode/MemoryModule)
				* Library to load a DLL from memory.
		PEB
			https://github.com/hasherezade/process_chameleon
			https://www.youtube.com/watch?app=desktop&v=3wZCVEJOGos
		Persistence
			https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html
			https://github.com/FortyNorthSecurity/PersistAssist
		PIC
			https://yurichev.com/news/20211015_PIC/
			https://bruteratel.com/research/feature-update/2021/01/30/OBJEXEC/
			https://github.com/mattifestation/PIC_Bindshell/tree/master/PIC_Bindshell
			HandleKatz
				https://raw.githubusercontent.com/codewhitesec/HandleKatz/main/PICYourMalware.pdf
				https://vxug.fakedoma.in/papers/VXUG/Exclusive/FromaCprojectthroughassemblytoshellcodeHasherezade.pdf
				https://github.com/thefLink/C-To-Shellcode-Examples
				https://github.com/codewhitesec/HandleKatz
			* [PIC Your Malware! - Ben Heimerdinger and Sebastian Feldmann(BruCON0x0D)](https://www.youtube.com/watch?v=8UCBvvJZw2U)
				* "This talk outlines our approaches to build customized tools and hiding them from analysts and security products on the endpoint. It will be explained how popular PE loading techniques, such as Reflective DLLs or Donut/sRDI can be spotted by artefacts they leave in memory and how position independent code (PIC) can be leveraged to avoid these artefacts. Nevertheless utilizing these techniques allows rapidly building and deploying payloads. It will be demonstrated how we build and protect our payloads with an automated build server supporting multiple file formats and environmental crypting."
			* [sRDI](https://github.com/monoxgas/sRDI)
				* Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode
			* [pe_to_shellcode](https://github.com/hasherezade/pe_to_shellcode)
				* "The goal of this project is to provide a possibility to generate PE files that can be injected with minimal effort. It is inspired by Stephen Fewer's ReflectiveDLLInjection - but the difference is that with pe2shc you can add the reflective loading stub post-compilation. Also, the header of the PE file is modified in such a way, that you can start executing the injected buffer from the very beginning - just like you would do with a shellcode. It will automatically find the stub, and continue loading the full PE."
			* [Donut](https://github.com/TheWover/donut)
				* Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
			* [donutCS](https://github.com/n1xbyte/donutCS)
				* .NET Core version of donut shellcode generator.
		PrivEsc
			https://github.com/SecIdiot/ANGRYORCHARD
			https://github.com/DarkCoderSc/PowerRunAsSystem
		Processes
			https://github.com/GeorgyFirsov/ntp
			https://github.com/je5442804/CreateProcessInternalW-Full
			https://github.com/SinaKarvandi/Process-Magics
			https://blog.trailofbits.com/2022/12/20/process-reparenting-microsoft-windows/
			Discovery
			Modification of
			Tradecraft
				https://github.com/D0pam1ne705/Direct-NtCreateUserProcess
				https://bbs.pediy.com/thread-272798.htm
				https://github.com/SinaKarvandi/Process-Magics
				https://github.com/trickster0/CReadMemory
				https://github.com/Microwave89/createuserprocess
				https://github.com/BlackOfWorld/NtCreateUserProcess
				https://github.com/waleedassar/ProcessExplorer_Hidden_DllName
				https://github.com/rad9800/misc/blob/main/ClearVeh.c
				https://www.semanticscholar.org/paper/Hiding-Process-Memory-Via-Anti-Forensic-Techniques-Palutke-Block/70f2c5dd6cc1f446bf9a629bf6027fdcf47c6915
				https://tastypepperoni.medium.com/running-exploit-as-protected-process-ligh-from-userland-f4c7dfe63387
				https://github.com/tastypepperoni/RunAsWinTcb
				https://github.com/helpsystems/CreateProcess
				https://phasetw0.com/windows-internals/optimizing_function_resolving/
					https://github.com/ph4s3tw0/GetProcAddressCaseStudies
			https://tbhaxor.com/windows-process-listing-using-wtsapi32/
			https://tbhaxor.com/windows-process-listing-using-wtsapi32-2/
			https://github.com/Broihon/ProcessInfo
			* [SleepyCrypt](https://github.com/SolomonSklash/SleepyCrypt)
			* [HideTS](https://github.com/DavidXanatos/HideTS)
				* DLL and API hooking example to hide running in a Terminal Session
			* [KIT](https://github.com/dzonerzy/KIT)
				* Keep In Touch - C single header library for IPC
		PPL
			https://www.redcursor.com.au/blog/bypassing-lsa-protection-aka-protected-process-light-without-mimikatz-on-windows-10
		RDLL
			https://github.com/quantumcore/ReflectiveDLLInjectionTutorial
		Registry
			https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry
			https://github.com/skelsec/aiowinreg
			https://docs.microsoft.com/en-us/windows/win32/sysinfo/using-the-registry
						* [RegistryStrikesBack](https://github.com/mdsecactivebreach/RegistryStrikesBack)
				* RegistryStrikesBack allows a red team operator to export valid .reg files for portions of the Windows Registry via a .NET assembly that should run as a standard user.
		Rich Header
			http://ropgadget.com/posts/richheader_hunting.html
		RPC
			https://www.trustedsec.com/blog/rpc-programming-for-the-aspiring-windows-developer/
				https://github.com/trustedsec/Windows-MS-LSAT-RPC-Example
			https://sensepost.com/blog/2021/building-an-offensive-rpc-interface/
		Rootkit
			https://securityboulevard.com/2022/09/developing-a-hidden-virtual-file-system-capability-that-emulates-the-uroburos-rootkit/
				https://github.com/praetorian-inc/INTRACTABLEGIRAFFE
			https://github.com/JKornev/hidden
		ROP
			* [ropr](https://github.com/Ben-Lichtman/ropr)
				* A blazing fast multithreaded ROP Gadget finder. ropper / ropgadget alternative
		Samples (Notable)
			https://n1ght-w0lf.github.io/malware%20analysis/smokeloader/
			https://github.com/DanielAvinoam/ExplorerKillSwitch
			https://github.com/richkmeli/Richkware
			https://0xdarkvortex.dev/malware-on-steroids-part-1-simple-cmd-reverse-shell/
			* [malware-generator](https://github.com/SalahMSaleh/dropper-generator)
				* Simple project to generate 32bit or 64bit undetectable droppers from shellcodes
			https://blog.lumen.com/no-longer-just-theory-black-lotus-labs-uncovers-linux-executables-deployed-as-stealth-windows-loaders/
			https://github.com/DanielAvinoam/TheSubZeroProject
				https://niiconsulting.com/checkmate/2018/02/malware-development-welcome-dark-side-part-2-1/
				https://niiconsulting.com/checkmate/2018/03/malware-development-welcome-dark-side-part-2-2/
				https://niiconsulting.com/checkmate/2018/03/malware-development-welcome-dark-side-part-3/
				https://niiconsulting.com/checkmate/2018/03/malware-development-welcome-to-the-dark-side-part-4/
		Sandbox-Avoidance
			https://web.archive.org/web/20210628002030/https://albocoder.github.io/malware/2021/06/01/SandboxStudy.html
			https://web.archive.org/web/20210726184727/https://albocoder.github.io/assets/pdf_files/malw_variability.pdf
		Services
			https://docs.microsoft.com/en-us/dotnet/framework/windows-services/
			https://docs.microsoft.com/en-us/dotnet/framework/windows-services/walkthrough-creating-a-windows-service-application-in-the-component-designer
			https://docs.microsoft.com/en-us/windows/win32/api/sysinfoapi/
		Shellcode
			https://www.youtube.com/channel/UC5gDrP_imTvYtMSrFRb08lA?app=desktop
			https://github.com/jackullrich/ShellcodeStdio
			https://github.com/KiFilterFiberContext/warbird-hook
			https://mez0.cc/posts/jumping-to-conclusions/
			https://www.ired.team/offensive-security/code-injection-process-injection/loading-and-executing-shellcode-from-portable-executable-resources
			https://alice.climent-pommeret.red/posts/a-syscall-journey-in-the-windows-kernel/
			https://cocomelonc.github.io/tutorial/2021/10/30/windows-shellcoding-2.html
			https://cocomelonc.github.io/tutorial/2021/10/31/windows-shellcoding-3.html
			https://github.com/Cracked5pider/ShellcodeTemplate
			https://github.com/gpoulios/ROPInjector
			https://cocomelonc.github.io/malware/2022/12/21/malware-tricks-25.html
			https://github.com/OmerYa/ROPInjector
			https://github.com/VirtualAlllocEx/Create-Thread-Shellcode-Fetcher
			https://phasetw0.com/malware/writing-optimized-windows-shellcode-in-c/
			https://github.com/hacksysteam/ShellcodeOfDeath
			https://github.com/rainerzufalldererste/windows_x64_shellcode_template
			https://github.com/killeven/DllToShellCode
			https://github.com/boku7/x64win-AddRdpAdminShellcode
			Process Fiber Local Shellcode Execution - https://github.com/jsecu/7DaysofRed/blob/main/Day1.md	
			https://github.com/mattifestation/PIC_Bindshell
			https://github.com/r00tkiter/PE2Shellcode
			https://github.com/timwhitez/Bof2PIC
			https://github.com/SecIdiot/TransitionalPeriod
			https://github.com/peterferrie/win-exec-calc-shellcode
			https://github.com/Wra7h/FlavorTown
			https://github.com/D1rkMtr/UUIDRegistryShellcode
			* [Defending Your Malware - Dylan Halls(2020)](https://blog.dylan.codes/defending-your-malware)
				* [Defensive Injector](https://github.com/bats3c/DefensiveInjector)
		Stack
			https://www.solomonsklash.io/SleepyCrypt-shellcode-to-encrypt-a-running-image.html
			https://github.com/C485/ReturnAddressHider
		Syscalls
			https://fool.ish.wtf/2022/11/detecting-indirect-syscalls.html
			https://www.youtube.com/watch?v=ME7IGHPcSKw
			https://lowery.tech/building-a-custom-shellcode-loader-with-syswhispers-to-utilise-direct-syscalls/
			https://klezvirus.github.io/RedTeaming/AV_Evasion/NoSysWhisper/
			https://github.com/GetRektBoy724/SyscallShuffler
			https://the-deniss.github.io/posts/2022/12/08/hooking-system-calls-in-windows-11-22h2-like-avast-antivirus.html
			https://github.com/timwhitez/ReturnGate
			https://github.com/D1rkMtr/SSN_Resolver
			https://github.com/timwhitez/Spoofing-Gate
			https://github.com/ICode1709/syscall
			https://fool.ish.wtf/2022/09/d-generating-edr-internals-part-1.html
			https://github.com/janoglezcampos/rust_syscalls
			https://github.com/DallasFR/WalkerGate
			https://gitlab.com/Zer1t0/zsyscall
			https://github.com/Maldev-Academy/HellHall
			https://the-deniss.github.io/posts/2022/12/08/hooking-system-calls-in-windows-11-22h2-like-avast-antivirus.html
			https://github.com/thefLink/RecycledGate
			https://github.com/daem0nc0re/AtomicSyscall
			https://github.com/klezVirus/SysWhispers3
			https://github.com/seahop/SyscallProcScan
			https://www.mdsec.co.uk/2022/01/edr-parallel-asis-through-analysis/
			https://github.com/nick-frischkorn/SysWhispers-FunctionRandomizer
			https://github.com/rad9800/TamperingSyscalls
			https://github.com/janoglezcampos/rust_syscalls
			https://gitlab.com/ORCA000/perunsfart
			https://github.com/MaorSabag/Paruns-Fart
			https://github.com/Deputation/syscall_extractor
			https://fool.ish.wtf/2022/08/tamperingsyscalls.html
			https://www.mdsec.co.uk/2022/04/resolving-system-service-numbers-using-the-exception-directory/
			https://github.com/Bw3ll/ShellWasp
			https://www.youtube.com/watch?v=Uba3SQH2jNE&list=RDCMUC--DwaiMV-jtO-6EvmKOnqg&start_radio=1
			https://jmpesp.me/malware-analysis-syscalls-example/
				https://github.com/m0rv4i/SyscallsExample
			https://www.solomonsklash.io/syscalls-for-shellcode-injection.html
			https://captmeelo.com/redteam/maldev/2021/11/18/av-evasion-syswhisper.html
			https://www.cyberbit.com/blog/endpoint-security/malware-mitigation-when-direct-system-calls-are-used/
			https://www.cloaked.pl/2022/04/on-how-we-can-keep-whispering-the-syscalls/
			* [Worried about EDR hooking catching you out? - benpturner(2020)](https://redteaming.co.uk/2020/12/01/worried-about-edr-hooking-catching-you-out/)
		Sysinfo
			https://docs.microsoft.com/en-us/windows/win32/sysinfo/system-information
			https://docs.microsoft.com/en-us/windows/win32/sysinfo/system-information-functions
		Storage
			https://learn.microsoft.com/en-us/windows/win32/projfs/projected-file-system
			https://github.com/danielhodson/pyprojfs
			* [Abusing the GPU for Malware with OpenCL](https://eversinc33.com/posts/gpu-malware/)
				* [GpuDecryptShellcode](https://github.com/eversinc33/GpuDecryptShellcode)
		Syscalls
			https://github.com/waleedassar/SyscallNumberExtractor
			https://github.com/jnastarot/cleancall
			[Implementing Direct Syscalls Using Hell’s Gate - N4kedTurtle(2020)](https://teamhydra.blog/2020/09/18/implementing-direct-syscalls-using-hells-gate/)
			https://github.com/ryan-weil/HideProcessHook
			https://twitter.com/modexpblog/status/1613048505123344384
			https://0x00sec.org/t/bypassing-antivirus-userland-hooks-with-direct-system-calls-in-x64-bit-with-syswow64/27998
			https://github.com/mai1zhi2/SysWhispers2_x86
			https://gist.github.com/X-C3LL/ba905b10163f769061ce619f26c138b8
			https://blog.scrt.ch/2022/04/19/3432/
			https://redops.at/en/blog/direct-syscalls-a-journey-from-high-to-low
			https://github.com/panagioto/SyscallHide
			https://github.com/ChadMotivation/SysWhispers-FunctionRandomizer
			https://gist.github.com/X-C3LL/ba905b10163f769061ce619f26c138b8#file-freshycalls-vba-vba
			https://github.com/hzqst/Syscall-Monitor
			https://github.com/akkuman/getsyscallid
				https://idiotc4t.com/defense-evasion/dynamic-get-syscallid
			* [RedTeam Tricks Exposed - Reversing Engineering Syscalls To Evade Detection - OA Labs(2021)](https://www.youtube.com/watch?v=Uba3SQH2jNE&list=RDCMUC--DwaiMV-jtO-6EvmKOnqg&start_radio=1)
			* [SyscallHide](https://github.com/panagioto/SyscallHide)
				* Create a Run registry key with direct system calls. Inspired by @Cneelis 's Dumpert and SharpHide.
			* [Making NtCreateUserProcess Work - Cpt Meelo(2022)](https://captmeelo.com/redteam/maldev/2022/05/10/ntcreateuserprocess.html)
		Tokens
			https://medium.com/@seemant.bisht24/understanding-and-abusing-process-tokens-part-i-ee51671f2cfa
			https://medium.com/@seemant.bisht24/understanding-and-abusing-access-tokens-part-ii-b9069f432962
			https://cocomelonc.github.io/tutorial/2022/09/25/token-theft-1.html
			https://cocomelonc.github.io/tutorial/2022/10/28/token-theft-2.html
			https://github.com/secureworks/TokenMan
			https://xret2pwn.github.io/Building-Token-Vault-Part0x02/
			https://rastamouse.me/token-impersonation-in-csharp/
			https://github.com/winterknife/PINKPANTHER
			https://research.nccgroup.com/2023/11/10/demystifying-cobalt-strikes-make_token-command
		Tradecraft
			https://labs.nettitude.com/blog/vm-detection-tricks-part-1-physical-memory-resource-maps/
			https://labs.nettitude.com/blog/vm-detection-tricks-part-2-driver-thread-fingerprinting/
			https://blog.syscall.party/post/windows-10-stealthy-threads/
			https://github.com/mez-0/winrmdll
			https://www.solomonsklash.io/pe-parsing-defeating-hooking.html
			https://xret2pwn.github.io/Access-Token-Part0x01/
			https://stackoverflow.com/questions/4631292/how-to-detect-the-current-screen-resolution/34254926#34254926
			https://gist.github.com/rvrsh3ll/1e66f0f2c7103ff8709e5fd63ca346ac
			* [Abusing the Windows PowerManagement API - smelly__x, am0nsec](https://vxug.fakedoma.in/papers/VXUG/Exclusive/AbusingtheWindowsPowerManagementAPI.pdf)
		UEFI/NVRAM
			https://gist.github.com/jthuraisamy/e602d5d870230df3ce00178001f9ac16
		VEH
			https://guidedhacking.com/threads/veh-hooking-aka-pageguard-hooking-an-in-depth-look.7164/
			https://guidedhacking.com/threads/veh-hooking-hooking-via-forced-exception.11928/
		VirtualDesktop
			https://github.com/Grabacr07/VirtualDesktop
		WaaS
			https://docs.microsoft.com/en-us/windows/win32/sysinfo/update-assessor-service
		WinAPI
			https://github.com/microsoft/win32metadata
			http://undoc.airesoft.co.uk/
			https://caiorss.github.io/C-Cpp-Notes/WindowsAPI-cpp.html
			https://www.installsetupconfig.com/win32programming/
		WinRM
			https://mez0.cc/posts/winrm-reflective-dll/
		WoW64
			https://github.com/rwfpl/rewolf-wow64ext
			https://gist.github.com/aaaddress1/a62d4a2ea937598349cfe813b83dceb5
			https://github.com/bluesadi/Heavens-Gate
			https://github.com/alal4465/HeavensGateHook
			https://conference.hitb.org/hitbsecconf2021ams/sessions/wow-hell-rebuilding-heavens-gate/
				https://github.com/aaaddress1/wowGrail
	Windows
		* [SNOWCRASH](https://github.com/wintrmvte/SNOWCRASH)
			* SNOWCRASH creates a script that can be launched on both Linux and Windows machines. Payload selected by the user (in this case combined Bash and Powershell code) is embedded into a single polyglot template, which is platform-agnostic.
	* [Red Team TTPs Part 2: PUSH 0xPE, CALL 0xLOADER - paranoidninja(2020)](https://0xdarkvortex.dev/index.php/2020/10/08/red-team-ttps-part-2-push-0xpe-call-0xloader/)
	

Pentesting
	https://insinuator.net/2021/01/pentesting-the-elk-stack/
	* [Network Pivot & Pen Testing by Phillip Wylie(RedTeamVillage2020)](https://www.youtube.com/watch?v=YWFizR3iGSY&list=PLruly0ngXhPGvyl-gOp4d_TvIiedloX1l&index=23)
	https://github.com/stealth/crash


Physical
	https://warroom.rsmus.com/pentesting-restrictive-environments-part-1/
	https://warroom.rsmus.com/pentesting-restrictive-environments-part-2
	https://github.com/AreiousX/KiD
	https://sizeof.cat/post/usr-5637-usb-modem/
	https://scund00r.com/all/gear/2019/06/25/red-team-and-physical-entry-gear.html
	https://tomu.im/

Planning, Prep, Reporting
	https://git.culbertreport.com/posts/Adversary-Emulation-Exercise/


Purpleteam exercises
	https://www.youtube.com/watch?app=desktop&v=ab_Fdp6FVDI
	https://github.com/Sam0x90/CTI/tree/main/Adversary%20Emulation%20Plans/2022_Top35_Mitre
	https://www.youtube.com/watch?v=oGRUdAOuh_w
	https://www.youtube.com/watch?v=wfTMGTfr8gI
	https://github.com/zimnyaa/noWatch
	https://tishina.in/opsec/nowatch-prealpha-release
	https://www.youtube.com/watch?v=75z9kpP88ac
	https://www.youtube.com/watch?v=X4VuzccCDTU
	https://github.com/SecurityRiskAdvisors/indexes
	https://github.com/Karkas66/CelestialSpark
	https://medium.com/@ch33r10/lets-get-offensive-building-a-purple-culture-e9ea2d62bb23
	https://www.blumira.com/test-antivirus-edr-software/
	https://detect.fyi/purple-teaming-understand-pivoting-160609902ecf?gi=5e6eea3d28cc&utm_medium=email&utm_source=substack
	https://github.com/facebookincubator/TTPForge
	https://github.com/mthcht/Purpleteam
	https://github.com/DataDog/stratus-red-team
	https://github.com/austinsonger/Incident-Playbook
	https://www.youtube.com/watch?v=ab_Fdp6FVDI
	https://www.youtube.com/watch?v=KL4R4WV9MdY
	https://github.com/DataDog/threatest
	https://www.preludesecurity.com/blog/verified-security-tests-explained
	https://docs.google.com/spreadsheets/d/1wHRrqwb1chTWP8kQqJjA2Chl7bUtCxRlobiyT3V2thE/edit#gid=267180436
	https://www.ecb.europa.eu/paym/intro/news/html/ecb.mipnews220808.en.html
	https://rootsecdev.medium.com/kerberoasting-a-blue-team-perspective-85e8892a8157
	https://www.youtube.com/watch?v=0pp6xcFsXgE&list=PLmv8T5-GONwQq16OhfaU77KCq7UQGiZsr&index=7
	https://github.com/TH3xACE/EDR-Test
	https://github.com/code-scrap/ConferenceTalks/blob/main/%5BPDF%5D%5BFINAL%5D%20%5BPublished%5DHackers-Teaching-Hackers-Keynote%20.pdf
	https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008
	https://github.com/maddev-engenuity/AdversaryEmulation
	https://www.scythe.io/library/adaptive-emulation-part-2-execution-methods
	* [Rank Ordering Function Call Graph Paths - Jared Atkinson(2022)](https://typefully.com/jaredcatkinson/rank-ordering-function-call-graph-paths-AN4qxin)
		* https://gist.github.com/jaredcatkinson/014fd61dab5b01abfc791923b4a6efec
		* https://www.researchgate.net/post/What-is-the-metric-to-find-if-two-paths-in-a-directed-graph-are-similar
		* https://www.sciencedirect.com/science/article/pii/S0893965907001012
		* 



Ransomware
	https://github.com/NUL0x4C/Ultra
	https://github.com/malcomvetter/fake-ransomware
	https://github.com/SafeBreach-Labs/DoubleDrive
	https://github.com/0xFenrik/Povlsomware
	https://github.com/JoelGMSec/PSRansom
	https://idov31.github.io/2022/05/07/rust101-rustomware.html
	https://github.com/cdong1012/Rust-Ransomware
	https://github.com/JoelGMSec/PSRansom
	https://idov31.github.io/2022/05/07/rust101-rustomware.html
	https://github.com/ORCx41/Ultra
	https://github.com/NextronSystems/ransomware-simulator
	https://github.com/Idov31/rustomware
	https://github.com/M507/Proof-of-Concept-CSharp-Ransomware

Tactics
	https://attl4s.github.io/assets/pdf/UNDERSTANDING_AND_HIDING_YOUR_OPERATIONS.pdf
		https://vimeo.com/502507556
	https://www.youtube.com/watch?v=9iiQlBaGJQA&list=PL4pmLxkc7CTcukIlpD0UThT7Y_K09oxXe&index=7&t=12s
	https://twitter.com/an0n_r0/status/1619145879591735297
	https://github.com/miroslavpejic85/p2p
	https://redteamrecipe.com/40-Method-For-Privilege-Escalation/
	https://github.com/avgjoesecurity/CisternAttack
	https://www.f3rn0s.xyz/posts/reverse-socks/
	https://signal-labs.com/parsing-msdn-for-documented-technique-dev/
	https://posts.specterops.io/shadow-wizard-registry-gang-structured-registry-querying-9a2fab62a26f
	https://superuser.com/questions/363688/bidirectional-socat-functionality-with-nc
	https://en.wikipedia.org/wiki/Hashcash
	https://mrpowergamerbr.com/us/blog/2023-03-20-untangling-your-network-tailscale-in-docker-compose/
	https://david-gilbertson.medium.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5
	https://ijece.iaescore.com/index.php/IJECE/article/view/25216
	https://gitlab.com/wireshark/wireshark/-/issues/17232
	https://assume-breach.medium.com/home-grown-red-team-bypassing-applocker-uac-and-getting-administrative-persistence-88b85c81343e
	https://fortynorthsecurity.com/blog/finding-empty-systems/
	https://github.com/dsnezhkov/coalmine
	https://www.rapid7.com/blog/post/2023/02/09/evasion-techniques-uncovered-an-analysis-of-apt-methods/
	https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/
	https://posts.specterops.io/proxy-windows-tooling-via-socks-c1af66daeef3
	https://labs.nettitude.com/blog/repurposing-real-ttps-for-use-on-red-team-engagements/
	https://mrd0x.com/bypass-2fa-using-novnc
	https://github.com/xorrior/RemoteRecon
	https://medium.com/swlh/assembly-wrapping-a-new-technique-for-anti-disassembly-c144eb90e036
	https://medium.com/@0x4ndr3/starting-dynamic-analysis-on-a-windows-x64-rootkit-8c7a74871fda
	https://pulsesecurity.co.nz/articles/some-tailscale-tricks
	https://posts.inthecyber.com/leveraging-microsoft-teams-for-initial-access-42beb07f12c4?gi=b217d5454d15
	https://github.com/SygniaLabs/Qemuno
	https://nstarke.github.io/eeprom/nic/2022/05/22/mac-address-changing-revisited.html
	https://tishina.in/ops/imapbox-elastic
	https://www.youtube.com/watch?v=xCU47bJoLho
	https://github.com/gus33000/UUPMediaCreator
	https://www.theloopcast.com/e/examining-the-idea-of-the-offense-has-to-be-right-once-the-defense-has-to-be-right-every-time/
	* [How I hacked hundreds of companies through their helpdesk - Inti De Ceukelaire](https://medium.com/intigriti/how-i-hacked-hundreds-of-companies-through-their-helpdesk-b7680ddc2d4c)
	* [unindexed](https://github.com/mroth/unindexed/blob/master/README.md)
		* The site is constantly searching for itself in Google, over and over and over, 24 hours a day. The instant it finds itself in Google search results, the site will instantaneously and irrevocably securely delete itself. Visitors can contribute to the public content of the site, these contributions will also be destroyed when the site deletes itself.
	* [Offensive Javascript Techniques for Red Teamers - Dylan Ayrey, Christian Frichot(BSidesSF2021)](https://www.youtube.com/watch?v=hKdcDce3FW4)
		* AppSec is often very heavily focused on pre-exploitation. Frameworks like BeEF break this norm a little and can be used as tools to move laterally from the browser, to implant malware on adjacent machines. Unfortunately, performing network reconnaissance with JavaScript becomes tricky if the victim doesn't keep the tab open for long. This presentation will discuss relatively new techniques and features of JavaScript that have made it easier for sophisticated threat actors to craft JavaScript payloads that target internal network vulnerabilities, as fast as a person can think to close a tab. We'll also show new reconnaissance techniques traditionally used by red teams, post-malware implant, that can be used to get a foothold onto a network from a browser, pre-malware implant. We'll also show some real examples of this, crafting external payloads that target internal assets at large companies, and we'll show how responsible disclosure for intranet facing bugs typically gets resolved.
	* [Kicking Down the Cross Domain Door Techniques for Cross Domain Exploitation - Billy K Rios, Raghav Dube(BHEU 2007)](https://www.blackhat.com/presentations/bh-europe-07/Dube-Rios/Whitepaper/bh-eu-07-rios-WP.pdf)
	* [Adventures in Dynamic Evasion - Matt Hand(2020)](https://posts.specterops.io/adventures-in-dynamic-evasion-1fe0bac57aa)
	* [Operator's Decalogue - reenz0h@Sektor7](https://blog.sektor7.net/#!res/2021/opdec.md)
	Supply Chain
		* [Supply Chainsaw - Matt "scriptjunkie" Weeks(DerpCon2020](https://www.youtube.com/watch?v=aEeXv5clL7c&list=PLCXnHhr5mRLzcvpFSj389dO7ro2spPLTe&index=10)
			*  Supply chain attacks are a gold standard of exploitation. Malicious software coming through the same channels as legitimate software is not in your threat model since it is nearly impossible to defend against. But supply chain attacks are often assumed to be expensive, time-consuming, and personally risky; exclusively the domain of intelligence services or well-funded criminal groups. This talk will show how anyone can launch similar software supply chain attacks that are effective against a global audience, and do so in ways that are nearly impossible to trace. It will examine numerous popular software distribution methods and show how most of them have readily exploitable weaknesses.  For the popular software repositories, this talk will demonstrate how easy it is to upload unverified malicious code, and how it will be executed on countless systems with just a single errant keystroke or no mistake at all. This presentation will show how comprehensive public information also enables us to identify and target individuals trusted by enormous user bases and automate credential theft and infection of widely trusted software from source to distribution to end-user. Finally, this talk will show the results when many of these actions were performed in the wild with proof-of-concept non-malicious packages created to test and validate these infection vectors.
		* [Hacking the Supply Chain - Shlomi Oberman, Moshe Kol, Ariel Schön(Defcon2020)](https://www.youtube.com/watch?v=wHsjf2mAHIM)
			* This is the story of how we found and exploited a series of critical vulnerabilities (later named Ripple20) affecting tens or hundreds of millions of IoT devices across all IoT sector conceivable - industrial controllers, power grids, medical, home, networking, transportation, enterprise, retail, defense, and a myriad of other types of IoT devices, manufactured and deployed by the largest American and international vendors in these fields. These vulnerabilities were found in a TCP/IP software library located at the very beginning of a complex supply chain and have lurked undetected for at least 10 years, likely much more. Over the past two decades this library has spread around the world by means of direct use as well as indirectly, through ""second hand"" use, rebranding, collaborations, acquisitions and repackaging, having been embedded and configurated in a range of different ways. Many of the vendors indirectly selling and using this library were not aware of their using it. Now that they know, the patch propagation dynamics are very complex and may not be possible in some cases. In this presentation, we will discuss one of the vulnerabilities in technical depth, demonstrating an RCE exploit on a vulnerable device. We will explain how the vulnerabilities became so widespread, and what we still don’t know. We will speculate as to why these vulnerabilities survived for so long and show why some vendors are worse affected than others.
Teams

Training
	https://www.cybrary.it/info/content/guerrilla-red-team-decentralize-the-adversary/
	https://www.irongeek.com/i.php?page=videos/derbycon7/t106-war-stories-on-embedded-security-pentesting-iot-building-managers-and-how-to-do-better-dr-jared-demott

TTPs

TTP Dev


Writeups
	https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network
	https://assume-breach.medium.com/home-grown-red-team-using-lnk-files-to-bypass-applocker-3fb1ecae291f
	https://dmcxblue.net/2023/09/19/how-to-rob-a-bank/



