SquidC5 - Security-first AI-native C5 teamserver (Command · Control · Cognitive · Collaborative · Coordination)
GitHub - SquidSec/SquidC5: Security-first AI-native C5 teamserver (Command · Control · Cognitive · Collaborative · Coordination) for authorized red team & pentest. Built by SquidSec.
Security-first AI-native C5 teamserver (Command · Control · Cognitive · Collaborative · Coordination) for authorized red team & pentest. Built by SquidSec. - SquidSec/SquidC5
github.com
Shellph - a portable command-line utility designed to automate encryption and obfuscation of arbitrary shellcode
GitHub - xirtam2669/Shellph: Shellph is a portable command-line utility designed to automate encryption and obfuscation of arbitrary shellcode. Named after my cat (Belph)
Shellph is a portable command-line utility designed to automate encryption and obfuscation of arbitrary shellcode. Named after my cat (Belph) - xirtam2669/Shellph
github.com
📝 Earlier this week, I wrote an article about how to abuse AMSI for persistence and detection guidance. You can find the visualization diagram below. 🔗 ipurple.team/2026/07/13/a...
🎙️ Threat actors with elevated permissions could register a fake AMSI provider to establish persistence. 𝑫𝒆𝒕𝒆𝒄𝒕𝒊𝒐𝒏 𝑺𝒕𝒓𝒂𝒕𝒆𝒈𝒊𝒆𝒔 ✅️ 7 - Sysmon Fake AMSI Provider DLL ✅️ 4663 - Modification of HKLM\SOFTWARE\Microsoft\AMSI\Providers Registry Key ✅️ 4688 - regsvr32 Process ✒️ ipurple.team/2026/07/13/a...
AMSI Provider
The Antimalware Scan Interface (AMSI) is a Microsoft control that directs PowerShell content to the installed antimalware engine or EDR to conduct a scan and identify malicious indicators. However,…
ipurple.team
Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender.
GitHub - Chaelsoo/nimcrypt: Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender.
Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender. - Chaelsoo/nimcrypt
github.com
PhantomFS - a Windows honeypot that projects convincing decoy files, credentials, financials, SSH keys, into a virtual directory via ProjFS, then fires instant Event Log and Toast alerts the moment an attacker opens one.
GitHub - AlloySecureGroup/PhantomFS: PhantomFS is a Windows honeypot that projects convincing decoy files — credentials, financials, SSH keys — into a virtual directory via ProjFS, then fires instant ...
PhantomFS is a Windows honeypot that projects convincing decoy files — credentials, financials, SSH keys — into a virtual directory via ProjFS, then fires instant Event Log and Toast alerts the mom...
github.com
P³-Shellcode Loader - a loader that implements a code injection technique which leverages the Process Parameters structure as an execution and staging location for shellcode injection into remote processes, without triggering common detection mechanisms.
GitHub - Orange-Cyberdefense/p3-loader: P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an execution and staging location...
P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an execution and staging location for shellcode injection into remote ...
github.com
Process Parameter Poisoning - an attack technique that is used to inject code on foreign processes, without triggering typical detection mechanisms.
SensePost | Process Parameter Poisoning
sensepost.com
A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Sleep Obfuscation github.com/xec412/XeraLdr
GitHub - xec412/XeraLdr: A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Sleep Obfuscation.
A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Sleep Obfuscation. - xec412/XeraLdr
github.com
Windows Service - Playbook & Detection Strategies ipurple.team/2026/07/06/w...
Windows Service
Windows Services are a common target for adversaries because they provide a reliable mechanism for executing code with elevated privileges, maintaining persistence, and blending malicious activity …
ipurple.team
Hollow - a shellcode loader generator. You give it a raw shellcode binary and a profile, and it spits out a compiled Windows PE loader with your shellcode encrypted inside.
GitHub - Chaelsoo/Hollow
Contribute to Chaelsoo/Hollow development by creating an account on GitHub.
github.com
SpotifyC2 - a cybersecurity research project that demonstrates cloud-based command communication using Spotify playlists for command retrieval and Telegram for output delivery, without requiring the Spotify Web API.
GitHub - NirvanaOn/SpotifyC2: SpotifyC2 is a cybersecurity research project that demonstrates cloud-based command communication using Spotify playlists for command retrieval and Telegram for output de...
SpotifyC2 is a cybersecurity research project that demonstrates cloud-based command communication using Spotify playlists for command retrieval and Telegram for output delivery, without requiring t...
github.com
Abusing GitLab CI Runners as a Command and Control Framework vrls.ws/posts/abusin...
Abusing GitLab CI Runners as a Command and Control Framework
Explore how GitLab self-hosted runners can be repurposed as a fully functional Command and Control framework using a legitimate, digitally signed binary. Covers the GitRunner C2 proof-of-concept, exec...
vrls.ws
NebulaPulsar - a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX), originally developed as part of the Alien project.
GitHub - iss4cf0ng/NebulaPulsar: NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX), originally developed as part of the Alien project.
NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX), originally developed as part of the Alien project. - iss4cf0ng/NebulaPulsar
github.com
iPurple playbooks are now mapped to ATT&CK. The custom navigator has: 1️⃣ New Techniques with new ATT&CK IDs 2️⃣ Techniques and Sub-Techniques mapped to the iPurple playbook So if you are looking for a purple team playbook or detection guidance, visit the Navigator 🔗 navigator.ipurple.team
iPurple.team · ATT&CK Navigator
iPurple.team purple-team coverage matrix built on MITRE ATT&CK (Windows Enterprise).
navigator.ipurple.team
📢 QoS Policies - Restrict EDR agents Traffic from generating telemetry & Detection Strategies 𝐃𝐞𝐭𝐞𝐜𝐭𝐢𝐨𝐧 𝐒𝐭𝐫𝐚𝐭𝐞𝐠𝐲 - 𝐄𝐯𝐞𝐧𝐭 𝐈𝐃𝐬 ✅️️️ 5857 - CIM Provider ✅️️️ 4104 - PowerShell ScriptBlock ✅️️️ 4663 - Registry Key Modification ✅️️️ 4688 - Process Creation ✅️️️ qoswmi.dll 🖊️ ipurple.team/2026/06/17/q...
QoS Policies
In Windows, a Quality of Service (QoS) policy is a rule that handles outbound network traffic. Specifically, it is used to cap the outbound bandwidth of a process, port, or protocol. Organizations …
ipurple.team
Detection of EntryPoint Hijacking consists of the following: 1️⃣ EntryPoint address escapes the module’s DllBase range 2️⃣ MEM_IMAGE → MEM_PRIVATE transition 3️⃣ OriginalBase fails validation ✒️ Read More: ipurple.team/2026/05/13/e...
🎙️ EntryPoint Hijacking introduces a stealthier approach to code injection. 🛠️ 𝐀 𝐍𝐞𝐰 𝐃𝐞𝐭𝐞𝐜𝐭𝐢𝐨𝐧‑𝐂𝐚𝐩𝐚𝐛𝐢𝐥𝐢𝐭𝐲 is introduced that monitors: 🧠 The memory address of the EntryPoint 🧬 Changes to the EntryPoint memory type 🛑 OriginalBase validity ✒️ 𝐑𝐞𝐚𝐝 𝐭𝐡𝐞 𝐟𝐮𝐥𝐥 𝐚𝐫𝐭𝐢𝐜𝐥𝐞 ipurple.team/2026/05/13/e...
EntryPoint Hijacking
The technique of EntryPoint Hijacking introduces a stealthier approach to code injection as it doesn’t use API calls that create a new thread within the context of a process, and it independe…
ipurple.team
🚨 Cross‑Session Activation is a detection gap hiding in plain sight. 💡 The technique abstract below highlights the minimum viable signals for defenders. 💭 Interesting to know if this technique is part of your threat emulation library. #detectionengineering #purpleteam #blueteam
