A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service.

Detect and respond to Cobalt Strike beacons using ETW.

FrostByte is a POC project that combines different defense evasion techniques to build better redteam payloads

WMEye is a post exploitation tool that uses WMI Event Filter and MSBuild Execution for lateral movement

LiquidSnake is a tool that allows operators to perform fileless lateral movement using WMI Event Subscriptions and GadgetToJScript

C# Lsass parser