Skip to content

v3.0
Compare
Choose a tag to compare
@Tylous Tylous released this 29 Nov 17:05
· 5 commits to main since this release
v3.0
f493c19
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.

New Features

  • Added direct and indirect Syscall methods.
  • Added support for different HTTP beacon Libraries.
  • Created a dynamic set of Magic_MZ header values to help avoid any detection rules looking for MZ in the PE header.
  • Created a dynamic function to generate unique Magic_PE header values.
  • Added Thread spoofing.
  • Created a unique thread-spoofing list of 9 of the most common Windows base thread modules along with a random number generator to ensure each base address spoofed is unique.
  • Updated the Pipe list to ones that are no longer linked to any IOCs.
  • Updated PE_Clone options and values to reflect the latest versions with the most recent version of Windows.
  • Stripped out IOCs related to Bofs and in-memory execution.
  • Added triggers for Post-ex UDRL cleanup.

Bug Fix

  • Fixed path issue with some post-ex processes
  • Fixed strepp for powerpick
Assets 6
Loading