Files

.gitbook
.vscode
lab
miscellaneous-reversing-forensics
offensive-security-experiments
offensive-security
- code-execution
- code-injection-process-injection
- credential-access-and-credential-dumping
- defense-evasion
  - README.md
  - acg-arbitrary-code-guard-processdynamiccodepolicy.md
  - av-bypass-with-metasploit-templates.md
  - bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis.md
  - bypassing-ids-signatures-with-simple-reverse-shells.md
  - bypassing-windows-defender-one-tcp-socket-away-from-meterpreter-and-cobalt-strike-beacon.md
  - commandline-obfusaction.md
  - commandline-obfuscation.md
  - detecting-hooked-syscall-functions.md
  - disabling-windows-event-logs-by-suspending-eventlog-service-threads.md
  - downloading-file-with-certutil.md
  - evading-windows-defender-using-classic-c-shellcode-launcher-with-1-byte-change.md
  - executing-csharp-assemblies-from-jscript-and-wscript-with-dotnettojscript.md
  - file-smuggling-with-html-and-javascript.md
  - finding-all-rwx-protected-memory-regions.md
  - how-to-unhook-a-dll-using-c++.md
  - masquerading-processes-in-userland-through-_peb.md
  - parent-process-id-ppid-spoofing.md
  - preventing-3rd-party-dlls-from-injecting-into-your-processes.md
  - retrieving-ntdll-syscall-stubs-at-run-time.md
  - t1027-obfuscated-powershell-invocations.md
  - t1045-software-packing-upx.md
  - t1096-alternate-data-streams.md
  - t1099-timestomping.md
  - t1140-encode-decode-data-with-certutil.md
  - t1158-hidden-files.md
  - unloading-sysmon-driver.md
  - using-native-syscalls-to-bypass-avs-edrs.md
  - using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs.md
  - windows-api-hashing-in-malware.md
- enumeration-and-discovery
- exfiltration
- initial-access
- lateral-movement
- persistence
- privilege-escalation
- red-team-infrastructure
- t1055-process-injection
- wip.md
.gitignore
README.md
SUMMARY.md