netbiosX

📢 AMSI Provider - Playbooks & Detection Strategies 🎙️ Threat actors with elevated permissions could abuse this behaviour and register a fake AMSI provider to establish persistence. 𝑫𝒆𝒕𝒆𝒄𝒕𝒊𝒐𝒏 𝑺𝒕𝒓𝒂𝒕𝒆𝒈𝒊𝒆𝒔 ✅ 7 - Sysmon Fake AMSI Provider DLL ✅ 4663 - Modification of HKLM\SOFTWARE\Microsoft\AMSI\Providers Registry Key ✅ 4688 - regsvr32 Process 🖊️ https://ipurple.team/2026/07/13/amsi-provider/ #redteam #purpleteam #ipurple

Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender https://github.com/Chaelsoo/nimcrypt

A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Sleep Obfuscation. https://github.com/xec412/XeraLdr #redteam

WalkerGate - A method to take syscall with memory parsing of ntdll https://github.com/DallasFR/WalkerGate #redteam