Windows system utilities to maximize productivity

.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!

PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)

EarTrumpet - Volume Control for Windows

Covenant is a collaborative .NET C2 framework for red teamers.

Trying to tame the three-headed dog.

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

Tool to find metadata and hidden information in the documents.

A command line C# REPL with syntax highlighting – explore the language, libraries and nuget packages interactively.

Attack Surface Analyzer can help you analyze your operating system's security configuration for changes during software installation.

An open-source, free protector for .NET applications

Identifies the bytes that Microsoft Defender flags on.

Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Pers…

More than a ReClass port to the .NET platform.

Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019

Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities

Active Directory certificate abuse.

Collection of Offensive C# Tooling

A .net OLE/COM viewer and inspector to merge functionality of OleView and Test Container

The Hunt for Malicious Strings

Identifies the bytes that Microsoft Defender / AMSI Consumer flags on.

Hunts out CobaltStrike beacons and logs operator command output

PoCs and tools for investigation of Windows process execution techniques

Kernel mode WinDbg extension and PoCs for token privilege investigation.

A C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation.

"Golden" certificates

Remote Kerberos Relay made easy! Advanced Kerberos Relay Framework

A tool to help query AD via the LDAP protocol

Example code samples from our ScriptBlock Smuggling Blog post