awesome-windows-security

List of awesome Windows security resources

This list is for anyone wishing to learn offensive Windows security. The list will for the most part consist of tools available on Github.

The tools are categorized according to Adversarial Tactics and Techniques based on Mitre ATT&CK. Some tools fit several technqiues and some doesn't quite fit anywhere. I appreciate any help with finding the right tactics and techniques.

You can contribute by sending pull requests, create issues with suggestions or write to me on Twitter @chryzsh. I have made a template for adding new tools here -> Contributing

Table of Contents

• Initial Access
• Execution
• Persistence
• Privilege Escalation
• Defense Evasion
• Credential Access
• Discovery
• Lateral Movement
• Collection
• Exfiltration
• Command and Control

---

• Misc
• Gitbooks
• Ebooks
• Defense
• Twitter
• Contributing

↑ Initial Access

T1203 - Exploitation for Client Execution

• ruler - Gain shell through Exchange rules

↑ Execution

T1047 - Windows Management Instrumentation

• SharpWMI - C# implementation of various WMI functionality.

↑ Persistence

• WheresMyImplant - Contains the tooling nessessary to gaining and maintain access to target system. It can also be installed as WMI provider for covert long term persistence.

↑ Privilege Escalation

Uncategorized

• PowerUp - PowerUp aims to be a clearinghouse of common Windows privilege escalation vectors that rely on misconfigurations.
• SharpUp - C# port of various PowerUp functionality.

T1068 - Exploitation for Privilege Escalation

• alpc-diaghub - Utilizing the ALPC Flaw in combiniation with Diagnostics Hub as found in Server 2016 and Windows 10.

T1134 - Access Token Manipulation

• juicy-potato - Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM.
  • Procedure
  • Article - Juicy Potato (abusing the golden privileges)
• Tokenvator - A tool to elevate privilege with Windows Tokens

↑ Defense Evasion

AMSI bypassing

• Article - Oh No! AMSI blocked the AMSI Bypass! What now? - Works on W10 1803 - 09.11.18
• Article - AmsiScanBuffer Bypass - Part 1 - Works on W10 1803 - 01.11.18
• Article - Undetectable C# & C++ Reverse Shells

Log removal

• Invoke-Phant0m - This script walks thread stacks of Event Log Service process (spesific svchost.exe) and identify Event Log Threads to kill Event Log Service Threads. So the system will not be able to collect logs and at the same time the Event Log Service will appear to be running.

T1089 - Disabling Security Tools

• Procedure - Remotely Enumerate Anti-Virus Configurations
• Procedure - Remotely Modify Anti-Virus Configurations

T1027 - Obfuscated Files or Information

• mimikatz_obfuscator.sh - Obfuscation tool for Mimikatz.

T1055 - Process Injection

• SharpCradle - Download and execute .NET binaries into memory.

↑ Credential Access

T1208 - Kerberoasting

• Rubeus - C# toolset for raw Kerberos interaction and abuses.
  • Procedure - Github Page
  • Article - From Kekeo to Rubeus

T1081 - Credentials in Files

• KeeThief - Methods for attacking KeePass 2.X databases, including ing of encryption key material from memory.
• SharpCloud - C# utility for checking for the existence of credential files related to Amazon Web Services, Microsoft Azure, and Google Compute.
• credgrap_ie_edge - Extract stored credentials from Internet Explorer and Edge.

T1214 - Credentials in Registry

• windows_sshagent_extract - PoC code to extract private keys from Windows 10's built in ssh-agent service.
  • Procedure / Article - Extracting SSH Private Keys from Windows 10 ssh-agent

T1110 - Brute Force

• MailSniper - Searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.)
• DomainPasswordSpray - PowerShell tool to perform a password spray attack against users of a domain.
• SprayingToolkit - Scripts to make password spraying attacks against Lync/S4B & OWA a lot quicker, less painful and more efficient

T1003 - Credential Dumping

• mimikatz - Dumping credentials in Windopws
• Internal-Monologue - Retrieving NTLM Hashes without Touching LSASS.
• lazykatz - Lazykatz is an automation developed to extract credentials from remote targets protected with AV and/or application whitelisting software.
• poshkatz - PowerShell module for Mimikatz
• Powerdump.ps1 - Dumping SAM from Powershell

T1171 - LLMNR/NBT-NS Poisoning

• Responder - Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
• Inveigh - Windows PowerShell ADIDNS/LLMNR/mDNS/NBNS spoofer/man-in-the-middle tool.
• InveighZero - C# LLMNR/NBNS spoofer

↑ Discovery

• PowerView Dev Branch - Enumerating AD with Powershell. The dev branch is specifically recommended for its ability to specify credentials using the -Credential option.
• SharpView - C# implementation of harmj0y's PowerView
• BloodHound - Graphically map Active Directory environment.
• SharpHound - The BloodHound C# Ingestor

T1135 - Network Share Discovery

• SmbScanner - A Smb Scanner written in powershell Extracted from PingCastle and adapted to fit in a script. Checks for SMBv1 and SMBv2 (SMBv3 is a dialect of SMBv2).

T1082 - System Information Discovery

• Windows-Exploit-Suggester - This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules available for the missing bulletins.

• Watson - C# implementation for quickly finding missing software patches for local privilege escalation vulnerabilities.

↑ Lateral Movement

• Procedure - Mimikatz Pass-The-Hash - mimikatz can perform the well-known operation 'Pass-The-Hash' to run a process under another credentials with NTLM hash of the user's password, instead of its real password.
• Tool - CrackMapExec - A swiss army knife for pentesting networks
• Article - A Red Teamer's guide to pivoting

↑ Collection

T1005 - Data from Local System

• Tool - mimikittenz - A post-exploitation powershell tool for extracting juicy info from memory.
• Tool - SlackExtract - A PowerShell script to download all files, messages and user profiles that a user has access to in slack.

↑ Exfiltration

T1048 - Exfiltration Over Alternative Protocol

• SharpBox - C# tool for compressing, encrypting, and exfiltrating data to using the DropBox API.

↑ Command and Control

Frameworks

• Empire - Empire is a PowerShell and Python post-exploitation agent.
• SILENTTRINITY - A post-exploitation agent powered by Python, IronPython, C#/.NET
  • Procedure
  • Article - Writing a basic Module for SILENTTRINITY
  • Article - The Rise of C# and using Kali as a C2 Server with SILENTTRINITY
• Cobalt Strike - Software for Adversary Simulations and Red Team Operations.

T1102 - Web Service

• Article - Cobaltstrike Over External C2 via Dropbox

↑ Defense

• awesome-windows-domain-hardening - A curated list of awesome Security Hardening techniques for Windows.
• UncoverDCShadow - Detect the use of the DCShadow attack.
• Seatbelt - Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.
• Pingcastle - Ping Castle is a tool designed to assess quickly the Active Directory security level with a methodology based on risk assessment and a maturity framework.
• WindowsDefenderATP-Hunting-Queries - Sample queries for Advanced hunting in Windows Defender ATP

↑ Misc

Post Exploitation Frameworks & Tools

• PowerSploit - A PowerShell Post-Exploitation Framework
• SharpSploit - .NET post-exploitation library written in C# that aims to highlight the attack surface of .NET and make the use of offensive .NET easier for red teamers.
• SharpSploitConsole - Console Application designed to interact with SharpSploit.
• SharpAttack - A simple wrapper for C# tools. It contains commands for domain enumeration, code execution, and other fun things.
• LOLBAS - every binary, script, and library that can be used for Living Off The Land techniques.
• DeathStar - Automate getting Domain Admin using Empire

Exploit Development

• awesome-windows-kernel-security-development
• awesome-windows-exploitation - A curated list of awesome Windows Exploitation resources, and shiny things.
• PowerShellArsenal - A PowerShell Module Dedicated to Reverse Engineering
• SharpCompile - SharpCompile is an aggressor script for Cobalt Strike which allows you to compile and execute C# in realtime.
• SharpGen - SharpGen is a .NET Core console application that utilizes the Rosyln C# compiler to quickly cross-compile .NET Framework console applications or libraries.

↑ Red Team

• Awesome-Red-Teaming
• Red Tips of Vysec
• Planning a Red Team exercise
• atomic-red-team
• Red-Team-Infrastructure-Wiki

↑ Gitbooks

• Vincentyiu
• ired.team
• DarthSidious

↑ Ebooks

• Advanced Penetration Testing: Hacking the World's Most Secure Networks
• Windows Internals, Part 1: System architecture, processes, threads, memory management, and more (7th Edition)
• How to Hack Like a LEGEND: A hacker’s tale breaking into a secretive offshore company (Hacking the Planet Book 7)

↑ Twitter

• Nikhil Mittal - @nikhil_mitt
• Marcello - @byt3bl33d3r
• Sean Metcalf - @PyroTek3
• Vincent Yiu - @vysecurity
• Cn33liz - @Cneelis
• Rasta Mouse - @_RastaMouse
• SpecterOps - @SpecterOps

↑ Contributing

If you want to contribute a technique please use the following template. You are allowed to link to multiple procedures and articles for each tool

### [T1234 - Name of Technique](https://attack.mitre.org/techniques/T1234/)
* [github-repo](https://github.com/username/github-repo) - Description from repo. Copypaste is allowed.
  * [Procedure](https://link.to.procedure.com)
  * [Article](https://link.to.article.com)