0x00check Goto Github PK

0x00check.github.io

amaterasu

Amaterasu terminates, or inhibits, protected processes such as application control and AV/EDR solutions by leveraging the Sysinternals Process Explorer driver to kill a process's handles from kernel mode.

exploitleakedhandle

Identify and exploit leaked handles for local privilege escalation.

find-userlandhooks

PowerShell script to find NTDLL functions that may be hooked by AV or EDR by comparing what exists on disk with the loaded ntdll module.

get-syscallid

PowerShell script to retrieve the system call numbers for Nt/Zw functions exported in NTDLL.

hunting-queries-detection-rules

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

ms13-098

PowerShell script to append data to executables without invalidating their digital signature. (MS13-098)

process_injection_framework

PIF is a tool that facilitates injecting & executing arbitrary code in remote processes through various process injection techniques.

pssetcreateprocessnotifyroutineex

Minimal driver that calls PsSetCreateProcessNotifyRoutineEx and writes basic process information to the kernel debugger. For educational purposes.