r/purpleteamsec bot

A no-reboot, in-memory Linux persistence PoC leveraging namespace joining, user-namespace elevation, and self‑deletion.

BamboozlEDR: A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.

The Silent Exfiltration: Zero Click Agentic AI Hack That Can Leak Your Google Drive with One Email

DNS Proxy for C2 Servers

Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations

The Hidden Gaps in Entra ID Linkable Token Identifier

Attack Graph Model Design Requirements and Examples

Lateral Movement - BitLocker

GitHound - a BloodHound OpenGraph collector for GitHub, designed to map your organization’s structure and permissions into a navigable attack‑path graph

Out-of-the-box CobaltStrike Beacon source code use C++

Accelerating Offensive R&D with LLMs

BloodHound v8: Usability, Extensibility, and OpenGraph

RingReaper: Linux post-exploitation agent that uses io_uring to stealthily bypass EDR detection by avoiding traditional syscalls.

Async BOFs - "Wake Me Up, Before You Go Go"

MSSQLHound: PowerShell collector for adding MSSQL attack paths to BloodHound with OpenGraph

Hells-Hollow: Hells Hollow Windows 11 Rootkit technique to Hook the SSDT via Alt Syscalls

SSDT Hooking via Alt Syscalls for ETW Evasion

An ADCS honeypot to catch attackers in your internal network.

DPAPI Backup Key Compromise Pt. 1: Some Forests Must Burn

RAITrigger technique that abuses the RAiForceElevationPromptForCOM RPC function in appinfo.dll to trigger SYSTEM authentication to an arbitrary UNC path. This can be useful for relaying or ADCS attacks in domain environments

Detecting ADCS Privilege Escalation

Monitor Cobalt Strike beacon for Windows tokens and gain Kerberos persistence

The RPC-function RAiForceElevationPromptForCOM from the appinfo.dll library allows SYSTEM coercion. This only works on domain joined systems. This function can be called from any low privileged user to trigger SYSTEM authentication to an arbitrary location

A small collection of Crystal Palace PIC loaders designed for use with Cobalt Strike

Escaping the Confines of Port 445

Make Sure to Use SOAP(y) - An Operators Guide to Stealthy AD Collection Using ADWS

netescape: Malware traffic obfuscation library

An Analysis of a Malicious Solana Open-source Trading Bot

x86-64 GetPC: SYSCALL

LudusHound - a tool for red and blue teams that transforms BloodHound data into a fully functional, Active Directory replica environment via Ludus for controlled testing