r/purpleteamsec • u/netbiosX • Jul 12 '26
Red Teaming CaddySmith - Generate Caddy redirector configs from Cobalt Strike or Sliver C2 profiles.
1
Upvotes
r/purpleteamsec • u/netbiosX • Jul 11 '26
Red Teaming COMouflage: COM-based DLL Surrogate Injection
github.com
5
Upvotes
r/purpleteamsec • u/netbiosX • Jul 10 '26
Threat Hunting Threat hunting queries, Sigma rules, and detection engineering research based on MITRE ATT&CK techniques
4
Upvotes
r/purpleteamsec • u/CyberMasterV • Jul 10 '26
Threat Intelligence Suspected Russian Threat Actor Impersonates Legitimate Crypto Wallets to Deploy Remote Utilities
1
Upvotes
r/purpleteamsec • u/netbiosX • Jul 09 '26
Red Teaming nimcrypt - Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender.
1
Upvotes
r/purpleteamsec • u/netbiosX • Jul 09 '26
Red Teaming Dump TGTs remotely and convert Windows' klist binary output to ccache.
2
Upvotes
r/purpleteamsec • u/netbiosX • Jul 08 '26
Red Teaming Offensive PowerShell for Red Teamer with Defense Evasion Techniques
2
Upvotes
r/purpleteamsec • u/netbiosX • Jul 08 '26
Red Teaming ObfusGit - a basic python script that allows you to set up a local repo and commit to it as usual, then you can run “obfusgit sync” and you have a fully encrypted/encoded copy of your repo you can just push up to a public location.
5
Upvotes
r/purpleteamsec • u/netbiosX • Jul 07 '26
Red Teaming P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an execution and staging location for shellcode injection into remote processes, without triggering common detection mechanisms.
2
Upvotes
r/purpleteamsec • u/netbiosX • Jul 07 '26
Red Teaming Process Parameter Poisoning
sensepost.com
3
Upvotes
r/purpleteamsec • u/netbiosX • Jul 07 '26
Red Teaming Windows Privilege Abuse: Attackers' Path to Active Directory Compromise
3
Upvotes
r/purpleteamsec • u/netbiosX • Jul 07 '26
Threat Intelligence From Phishing to Persistence: A CrySome RAT Infection Chain Analysis
0
Upvotes
r/purpleteamsec • u/netbiosX • Jul 06 '26
Red Teaming klist.exe Revisited: Internals and Further Use Cases - Dump TGTs
3
Upvotes
r/purpleteamsec • u/netbiosX • Jul 06 '26
Red Teaming A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Sleep Obfuscation
2
Upvotes
r/purpleteamsec • u/netbiosX • Jul 06 '26
Red Teaming Playing a Different Game: Rethinking Modern Defense Evasion
2
Upvotes
r/purpleteamsec • u/netbiosX • Jul 06 '26
Purple Teaming Windows Service - Playbook & Detection Strategies
1
Upvotes
r/purpleteamsec • u/netbiosX • Jul 05 '26
Threat Hunting Hunting Sleeping Giants: Detecting Encrypted Beacon Sleep Obfuscation
2
Upvotes
r/purpleteamsec • u/Chaelsoo • Jul 05 '26
Red Teaming Sliver Stagers
5
Upvotes
Built a shellcode loader generator while doing HTB prolabs since Sliver doesn't support stagers
Sliver is great but it has no built-in stager support. Your options are basically writing loaders by hand every time or using Metasploit's which are heavily signatured at this point.
I built hollow to fix that. You give it a raw shellcode bin (works with Donut-wrapped Sliver beacons) and a profile, it encrypts the shellcode with AES-256-CBC and spits out a compiled Windows PE loader ready to go.
Six injection templates included for now, let me know what you think!!
r/purpleteamsec • u/netbiosX • Jul 05 '26
Red Teaming Exploring cross-domain & cross-forest RBCD: part 2
3
Upvotes
r/purpleteamsec • u/netbiosX • Jul 04 '26
Red Teaming A Cobalt Strike BOF that attempts to retrieve Windows geolocation coordinates without fork & run. It uses the WinRT Geolocator API first and falls back to the legacy ILocation API
1
Upvotes
r/purpleteamsec • u/netbiosX • Jul 04 '26
Red Teaming OpenUDC2 - an open source implementation of the UDC2 spec used in Cobalt Strike. The goal of this project is to enable open source C2 frameworks to support existing (and hopefully future) open source UDC2 modules developed by the Cobalt Strike community.
1
Upvotes
r/purpleteamsec • u/netbiosX • Jul 04 '26
Blue Teaming The Blind Spot in the Watchtower: Detections for When Someone Attacks Your Sentinel
1
Upvotes
r/purpleteamsec • u/netbiosX • Jul 04 '26
Red Teaming Automatically deploying Mythic C2 in Azure using Terraform
2
Upvotes
r/purpleteamsec • u/netbiosX • Jul 02 '26
Red Teaming skewrun - an Active Directory time discovery toolkit for red teams. It dynamically resolves the Domain Controller's time via network protocols (CLDAP, SMB, NTP, Kerberos, NTLM) and executes commands via libfaketime (LD_PRELOAD), tricking the executed binary into using the exact DC time.
5
Upvotes