Skip to content

@outflanknl Outflank B.V.

Change the repository type filter

All

    Repositories list

    35 repositories

    • RedELK

      Public
      Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
      securityelasticsearchkibanalogstashmonitoringsiemelasticred-teaming
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •392•2.6k•26•1•Updated Oct 30, 2025Oct 30, 2025

    • Presentations

      Public
      Presentation material presented by Outflank team members at public events.
      34•192•0•0•Updated Oct 1, 2025Oct 1, 2025

    • regcertipy

      Public
      Parses cached certificate templates from a Windows Registry file and displays them in the same style as Certipy does
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •9•84•0•0•Updated Jul 3, 2025Jul 3, 2025

    • Scripts

      Public
      Small scripts that make life better
      Python
      •76•300•4•0•Updated Jan 31, 2025Jan 31, 2025

    • nix_bof_template

      Public
      Beacon Object File (BOF) Template
      C
      •
      Apache License 2.0
      •6•58•1•0•Updated Nov 18, 2024Nov 18, 2024

    • macho-loader

      Public
      C++
      •15•86•0•0•Updated Sep 5, 2024Sep 5, 2024

    • edr-internals

      Public
      Tools for analyzing EDR agents
      C++
      •
      GNU General Public License v3.0
      •25•265•0•0•Updated Jun 10, 2024Jun 10, 2024

    • Training-MSOfficeOffensiveTradecraft

      Public
      Info related to the Outflank training: Microsoft Office Offensive Tradecraft
      17•50•0•0•Updated May 16, 2024May 16, 2024

    • HelpColor

      Public
      Agressor script that lists available Cobalt Strike beacon commands and colors them based on their type
      BSD 3-Clause "New" or "Revised" License
      •34•210•0•0•Updated Mar 18, 2024Mar 18, 2024

    • unmanaged-dotnet-patch

      Public
      Modify managed functions from unmanaged code
      C++
      •
      MIT License
      •8•52•0•0•Updated Feb 1, 2024Feb 1, 2024

    • EvilClippy

      Public
      A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.
      excelwordmalwarevbams-officemacropcodestomping
      C#
      •
      GNU General Public License v3.0
      •402•2.2k•18•3•Updated Dec 27, 2023Dec 27, 2023

    • C2-Tool-Collection

      Public
      A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.
      C
      •209•1.3k•1•2•Updated Oct 27, 2023Oct 27, 2023

    • RedELK-workshop

      Public
      Items related to the RedELK workshop given at security conferences
      7•29•0•0•Updated Sep 28, 2023Sep 28, 2023

    • FindObjects-BOF

      Public
      A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific loaded modules or process handles.
      47•274•0•1•Updated May 3, 2023May 3, 2023

    • WdToggle

      Public
      A Beacon Object File (BOF) for Cobalt Strike which uses direct system calls to enable WDigest credential caching.
      30•220•3•1•Updated May 3, 2023May 3, 2023

    • CS-Situational-Awareness-BOF

      Public
      Situational Awareness commands implemented using Beacon Object Files
      C
      •
      GNU General Public License v2.0
      •261•1•0•0•Updated Jan 27, 2023Jan 27, 2023

    • RedFile

      Public
      Serving files with conditions, serverside keying and more.
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •4•18•1•0•Updated May 26, 2022May 26, 2022

    • Spray-AD

      Public
      A Cobalt Strike tool to audit Active Directory user accounts for weak, well known or easy guessable passwords.
      C++
      •54•442•1•2•Updated Apr 1, 2022Apr 1, 2022

    • InlineWhispers

      Public
      Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF)
      Assembly
      •42•319•1•0•Updated Nov 9, 2021Nov 9, 2021

    • PrintNightmare

      Public
      C
      •69•344•2•0•Updated Sep 13, 2021Sep 13, 2021

    • external_c2

      Public
      POC for Cobalt Strike external C2
      C
      •31•139•0•0•Updated Sep 6, 2021Sep 6, 2021

    • Dumpert

      Public
      LSASS memory dumper using direct system calls and API unhooking.
      C
      •250•1.6k•5•1•Updated Jan 5, 2021Jan 5, 2021

    • Ps-Tools

      Public
      Ps-Tools, an advanced process monitoring toolkit for offensive operations
      C
      •84•355•0•0•Updated Dec 1, 2020Dec 1, 2020

    • TamperETW

      Public
      PoC to demonstrate how CLR ETW events can be tampered.
      C
      •31•191•0•0•Updated Mar 26, 2020Mar 26, 2020

    • Zipper

      Public
      Zipper, a CobaltStrike file and folder compression utility.
      C
      •49•225•1•0•Updated Jan 18, 2020Jan 18, 2020

    • Net-GPPPassword

      Public
      .NET implementation of Get-GPPPassword. Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
      C#
      •38•176•0•0•Updated Dec 18, 2019Dec 18, 2019

    • SharpHide

      Public
      Tool to create hidden registry keys.
      C#
      •96•489•2•0•Updated Oct 23, 2019Oct 23, 2019

    • Recon-AD

      Public
      Recon-AD, an AD recon tool based on ADSI and reflective DLL’s
      C++
      •56•330•1•0•Updated Oct 20, 2019Oct 20, 2019

    • Invoke-Templator

      Public
      A PowerShell script to parse the docx/docm file format and update the template location.
      PowerShell
      •7•17•0•0•Updated Oct 15, 2019Oct 15, 2019

    • Excel4-DCOM

      Public
      PowerShell and Cobalt Strike scripts for lateral movement using Excel 4.0 / XLM macros via DCOM (direct shellcode injection in Excel.exe)
      PowerShell
      •73•327•0•0•Updated Mar 26, 2019Mar 26, 2019