mattifestation

A PowerShell Module Dedicated to Reverse Engineering

CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.

Position Independent Windows Shellcode Written in C

A PoC WMI backdoor presented at Black Hat 2015

A PowerShell module to facilitate building, configuring, deploying, and auditing Windows Defender Application Control (WDAC) policies

Sysmon Tools for PowerShell

Easily define in-memory enums, structs, and Win32 functions in PowerShell

A module designed to simplify the creation, customization, and deployment of bootable Windows Preinstallation Environment (WinPE) images.

Execute PowerShell code at the antimalware-light protection level.

All materials from our Black Hat 2018 "Subverting Sysmon" talk

A reference Device Guard code integrity policy consisting of FilePublisher deny rules for published Device Guard configuration bypasses

A proof-of-concept subject interface package (SIP) used to demonstrate digital signature subversion attacks.

A set of tools to retrieve and parse TCG measured boot logs. Microsoft refers to these as Windows Boot Confirguration Logs (WBCL). In order to retrieve these logs, you must be running at least...

A collection of Windows software baseline notes with corresponding Windows Defender Application Control (WDAC) policies

BCD is a module to interact with boot configuration data (BCD) either locally or remotely using the ROOT/WMI:Bcd* WMI classes. The functionality of the functions in this module mirror that of...