firehol / blocklist-ipsets

ipsets dynamically updated with firehol's update-ipsets.sh script

S12cybersecurity / LogonStealer

Abuses the Credential Provider interface to steal plaintext passwords from logonui.exe via CredProvDataModel.dll hooks

security-attack / RingKiller

RingKiller — BYOD PoC for vulnerable driver DCRCVDrv.sys. Abuses IOCTL 0x2205C0 to kill arbitrary processes from ring 0 via ZwTerminateProcess. EDR/AV termination primitive. Lab only.