Linux kernel source tree

Defeating Windows User Account Control

Simple (relatively) things allowing you to dig a bit deeper than usual.

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

Handling pipe of commands like a single command

Identify common EDR processes, directories, and services. Simple BOF of Invoke-EDRChecker.