Windows Events Attack Samples
-
Updated
Jan 24, 2023 - HTML
#
windows-security
Here are 881 public repositories matching this topic...
Security sensor for realtime threat detection and protection
windows security instrumentation windows-kernel etw threat-hunting yara red-team security-tools malware-detection blue-team mitre-attack threat-detection endpoint-security purple-team windows-security detection-engineering endpoint-detection-response forencics
-
Updated
Oct 6, 2026 - Go
Resources About Windows Security. 1100+ Open Source Tools. 3300+ Blog Post and Videos.
-
Updated
Feb 20, 2020
Free Active Directory pentesting tool for Linux, macOS and Windows. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin. NIS2 / ISO 27001 reports.
windows macos active-directory bloodhound penetration-testing kerberos pentesting ctf privilege-escalation red-team pentest-tool adcs kerberoasting windows-security credential-dumping dcsync gmsa active-directory-certificate-services rbcd asreproast
-
Updated
Sep 30, 2026 - Python
Weaponize DLL hijacking easily. Backdoor any function in any DLL.
windows golang security backdoor persistence malware pentesting security-tools dll-hijacking redteam windows-security initial-access dll-sideloading
-
Updated
Aug 26, 2025 - Go
Automated CIS Benchmark Compliance Remediation for Windows Server 2019 with Ansible
ansible ansible-playbook cis automation ansible-role cybersecurity group-policy system-hardening cis-benchmark windows-server-2019 windows-security cis-hardening cis-security it-compliance secure-configuration secure-baseline windows-compliance cis-compliance enterprise-hardening windows-server-hardening
-
Updated
Jul 13, 2026 - YAML
🐟 PoC of a VBA macro spawning a process with a spoofed parent and command line.
-
Updated
Apr 28, 2020 - VBA
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
linux rust incident-response etw sysmon siem ebpf sigma yara security-tools linux-security malware-detection blue-team edr threat-detection security-monitoring endpoint-security windows-security detection-engineering endpoint-detection
-
Updated
Oct 7, 2026 - Rust
A desktop application that checks security-related settings and makes recommendations for improvements without requiring central device management or automated reporting.
electron javascript security hacktoberfest usable-security linux-security macos-security endpoint-security windows-security
-
Updated
Sep 6, 2023 - JavaScript
Blue Hammer by Nightmare-Eclipse Vulnerability Documentation & Reimplementation.
-
Updated
May 8, 2026 - C
Ansible CIS Benchmark Compliance Remediation for WINDOWS-2022
ansible ansible-playbook cis automation ansible-role cybersecurity group-policy system-hardening cis-benchmark windows-security cis-hardening cis-security it-compliance windows-server-2022 secure-configuration secure-baseline windows-compliance cis-compliance enterprise-hardening windows-server-hardening
-
Updated
Sep 29, 2026 - YAML
List of Awesome Windows Security Resources
-
Updated
Feb 17, 2023
Manipulating and Abusing Windows Access Tokens.
windows tokens post-exploitation uac-bypass pentest-tool windows-privilege-escalation windows-internals windows-security lateral-movement
-
Updated
Jan 15, 2021 - C++
🛡️ Security & Privacy Hardening Tool for Windows 11 26H2 — 630+ Settings, 7 Modules, BAVR Pattern.
security privacy cybersecurity hardening privacy-tools system-hardening windows-11 windows-security security-baseline windows-hardening microsoft-defender windows-privacy attack-surface-reduction telemetry-blocker windows-privacy-tool windows-security-software windows-security-tool noid-privacy windows-11-2026 26h2
-
Updated
Oct 7, 2026 - PowerShell
Automated CIS Benchmark Compliance Remediation for Windows Server 2016 with Ansible
ansible ansible-playbook cis automation ansible-role cybersecurity group-policy windows-server-2016 system-hardening cis-benchmark windows-security cis-hardening cis-security it-compliance secure-configuration secure-baseline windows-compliance cis-compliance enterprise-hardening windows-server-hardening
-
Updated
Aug 12, 2026 - YAML
First open-source DMA-based HWID spoofer written in Rust. Spoof hardware IDs via direct memory access.
rust reverse-engineering cybersecurity anti-cheat smbios dma pcie memory-forensics kernel-bypass security-research hwid windows-security hardware-id hwid-spoofer memprocfs hardware-spoofing patchguard-bypass dse-bypass
-
Updated
Mar 26, 2026 - Rust
Windows 11 secure group policy for standalone devices
-
Updated
Dec 14, 2025 - Batchfile
EDR & AV Bypass Arsenal— a comprehensive collection of tools, patches, and techniques for evading modern EDR and antivirus defenses.
apt reverse-engineering loader cybersecurity kernel-driver shellcode elf malware-analysis evasion hooking red-team 0day antivirus-evasion blue-team scriptblock windows-security edr-evasion edr-killer bypass-protection bypassmartscreen
-
Updated
Nov 17, 2025 - C
Run a program as TrustedInstaller (SYSTEM)
windows vb6 admin-tools security-tools uac-functionalities windows-admin windows-security windows-administration twinbasic
-
Updated
Apr 17, 2025 - Visual Basic 6.0
Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass
offensive-security cobalt-strike red-team bof av-bypass windows-security credential-dumping edr-bypass edr-evasion beacon-object-file lsass-dump edr-freeze ppl-bypass
-
Updated
Jan 29, 2026 - C
Add this topic to your repo
To associate your repository with the windows-security topic, visit your repo's landing page and select "manage topics."