Home

TrustMeBro Wiki

Welcome to the TrustMeBro wiki. This documentation covers usage, techniques, OPSEC, detection, and extending the toolkit.

Getting Started

If you want to use the tool right now, start here:

• Quick Start - Three scenarios, five steps each
• Tool Map - Which tool to use for what

Understanding the Techniques

If you want to know how each technique works:

• SigStash Payload Embedding
• SIP Hijacking
• Smart App Control Bypass
• FinalPolicy Bypass
• SIP Execution Surface
• WOW64 Split
• FormatGhost Persistence

Reference

• OPSEC Notes
• Detection Rules
• Extending the Tool
• Further Reading
• Research Notes