Snippet List

Technique Language Author OS Creation Date
XProtect Encryption Abuse Python 4 days, 3 hours
kernel flag inspection via sysctl Python fr0gger 4 days, 4 hours
Exfiltration via SMTP C# Tasdir 6 days, 2 hours
XBEL Recently Opened Files Check Python 1d8 1 week, 1 day
Virtualization/Sandbox Evasion: User Activity Based Checks Python 1d8 1 month, 1 week
Default Windows Wallpaper Check Golang 1d8 1 month, 1 week
Abusing the Return Pointer Assembly 0x_ror 1 month, 2 weeks
Impossible Disassembly Rust Gelven 1 month, 3 weeks
Detecting Virtual Environment Process C++ 0x_ror 1 month, 3 weeks
Process Argument Spoofing Python Wietze 1 month, 3 weeks
Process Argument Spoofing C Wietze 1 month, 3 weeks
Event Triggered Execution: Linux Inotify Python 1d8 1 month, 3 weeks
API Hammering C++ 0x_ror 1 month, 3 weeks
Replication Through Removable Media Python 1d8 2 months, 3 weeks
QEMU CPU brand evasion C++ kernelwernel 4 months, 1 week
bochs CPU oversights evasion C++ kernelwernel 4 months, 2 weeks
Impair Defenses: Disable Windows Event Logging PowerShell 0x0d4y 4 months, 4 weeks
Impair Defenses: Disable Windows Event Logging bash 0x0d4y 4 months, 4 weeks
AppInit DLL Injection C 1d8 4 months, 4 weeks
Hide Artifacts: Hidden Window C 1d8 4 months, 4 weeks
VboxEnumShares C++ HoIIovv 4 months, 4 weeks
Odd Thread Count C++ kernelwernel 4 months, 4 weeks
Hyper-V Signature C++ kernelwernel 4 months, 4 weeks
NtDelayExecution C d4rksystem 4 months, 4 weeks
APC injection FASM32 DarkCoderSc 7 months, 3 weeks
Runtime Function Decryption Python irfan_eternal 9 months, 3 weeks
Retrieve HDD Information C++ HoIIovv 9 months, 3 weeks
BuildCommDCBAndTimeoutA C Huntress Research Team 9 months, 3 weeks
Reflective DLL injection Delphi DarkCoderSc 1 year, 1 month
SMB / Named Pipes Delphi DarkCoderSc 1 year, 4 months
Filter
Clear