Windows Events Attack Samples
-
Updated
Jan 24, 2023 - HTML
#
windows-security
Here are 613 public repositories matching this topic...
Weaponize DLL hijacking easily. Backdoor any function in any DLL.
windows golang security backdoor persistence malware pentesting security-tools dll-hijacking redteam windows-security initial-access dll-sideloading
-
Updated
Aug 26, 2025 - Go
Free Active Directory pentesting tool for Linux. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin. NIS2 / ISO 27001 reports. No Windows needed.
linux active-directory bloodhound enumeration penetration-testing kerberos pentesting ctf privilege-escalation red-team pentest-tool adcs kerberoasting windows-security credential-dumping dcsync gmsa active-directory-certificate-services rbcd asreproast
-
Updated
Jul 25, 2026 - Python
Resources About Windows Security. 1100+ Open Source Tools. 3300+ Blog Post and Videos.
-
Updated
Feb 20, 2020
A desktop application that checks security-related settings and makes recommendations for improvements without requiring central device management or automated reporting.
electron javascript security hacktoberfest usable-security linux-security macos-security endpoint-security windows-security
-
Updated
Sep 6, 2023 - JavaScript
Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.
linux rust incident-response etw sysmon siem ebpf sigma yara security-tools linux-security malware-detection blue-team edr threat-detection security-monitoring endpoint-security windows-security detection-engineering endpoint-detection
-
Updated
Jul 27, 2026 - Rust
🐟 PoC of a VBA macro spawning a process with a spoofed parent and command line.
-
Updated
Apr 28, 2020 - VBA
List of Awesome Windows Security Resources
-
Updated
Feb 17, 2023
Manipulating and Abusing Windows Access Tokens.
windows tokens post-exploitation uac-bypass pentest-tool windows-privilege-escalation windows-internals windows-security lateral-movement
-
Updated
Jan 15, 2021 - C++
Windows 11 secure group policy for standalone devices
-
Updated
Dec 14, 2025 - Batchfile
Run a program as TrustedInstaller (SYSTEM)
windows vb6 admin-tools security-tools uac-functionalities windows-admin windows-security windows-administration twinbasic
-
Updated
Apr 17, 2025 - Visual Basic 6.0
Blue Hammer by Nightmare-Eclipse Vulnerability Documentation & Reimplementation.
-
Updated
May 8, 2026 - C
🛡️ Security & Privacy Hardening Tool for Windows 11 25H2 — 630+ Settings, 7 Modules, BAVR Pattern.
security automation privacy powershell cybersecurity compliance hardening privacy-tools system-hardening cis-benchmark windows-11 windows-security security-baseline enterprise-security windows-hardening microsoft-defender attack-surface-reduction telemetry-blocker windows-11-25h2 noid-privacy
-
Updated
May 18, 2026 - PowerShell
PolyEngine is an evasive PE packer designed for CTF challenges and low-level Windows security education. It focuses on bypassing EDR and AV heuristics through a layered stack of in-memory execution and obfuscation techniques.
-
Updated
Jul 22, 2026 - C
Automated CIS Benchmark Compliance Remediation for Windows Server 2019 with Ansible
ansible ansible-playbook cis automation ansible-role cybersecurity group-policy system-hardening cis-benchmark windows-server-2019 windows-security cis-hardening cis-security it-compliance secure-configuration secure-baseline windows-compliance cis-compliance enterprise-hardening windows-server-hardening
-
Updated
Jul 13, 2026 - YAML
Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass
offensive-security cobalt-strike red-team bof av-bypass windows-security credential-dumping edr-bypass edr-evasion beacon-object-file lsass-dump edr-freeze ppl-bypass
-
Updated
Jan 29, 2026 - C
Automated CIS Benchmark Compliance Remediation for Windows Server 2022 with Ansible
ansible ansible-playbook cis automation ansible-role cybersecurity group-policy system-hardening cis-benchmark windows-security cis-hardening cis-security it-compliance windows-server-2022 secure-configuration secure-baseline windows-compliance cis-compliance enterprise-hardening windows-server-hardening
-
Updated
Apr 17, 2026 - YAML
A collection of awesome ethical hacking and security related content!
linux security reverse-engineering pentesting bugbounty mobile-security ethical-hacking security-tools awesome-lists hacking-tools windows-security hacking-resources desktop-security
-
Updated
Jun 8, 2023
Cobalt Strike Aggressor Script for identifying security products on Windows hosts — six enumeration methods rated by noise level, from silent in-process BOF to full PowerShell/WMI.
post-exploitation offensive-security cobalt-strike bof redteam aggressor-script cobaltstrike-cna purple-team windows-security edr-evasion beacon-object-file edr-enumeration
-
Updated
Feb 6, 2026 - C
I-Espresso is a tool that enables users to generate Portable Executable (PE) files from batch scripts. Leveraging IExpress, it demonstrates how file extension spoofing can be used to evade detection.
hacking penetration-testing anonymous portable-executable ethical-hacking social-engineering windows-security educational-tool batch-scripting file-obfuscation iexpress extension-spoofing
-
Updated
Oct 17, 2024 - Batchfile
Improve this page
Add a description, image, and links to the windows-security topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the windows-security topic, visit your repo's landing page and select "manage topics."