12 open source projects by mattifestation

A PoC WMI backdoor presented at Black Hat 2015

Position Independent Windows Shellcode Written in C

Sysmon Tools for PowerShell

Easily define in-memory enums, structs, and Win32 functions in PowerShell

All materials from our Black Hat 2018 "Subverting Sysmon" talk

Analysis, detection, and removal of the "Power Worm" PowerShell-based malware

A PowerShell module to facilitate building, configuring, deploying, and auditing Windows Defender Application Control (WDAC) policies

BCD is a module to interact with boot configuration data (BCD) either locally or remotely using the ROOT/WMI:Bcd* WMI classes. The functionality of the functions in this module mirror that of bcdedit.exe.

A PowerShell Module Dedicated to Reverse Engineering

A reference Device Guard code integrity policy consisting of FilePublisher deny rules for published Device Guard configuration bypasses

A PowerShell binding for the Unicorn Engine

A PowerShell module to assist in parsing and managing catalog files.