Arsenal

Next-gen C2 framework — full PIC agent, DeathSleep, cloud dead-drops, LayeredSyscall, patchless ETW/AMSI, 50+ post-ex tasks

Polymorphic AV/EDR evasion — ChaCha20, environmental keying, 4 injection techniques, NTDLL unhooking, polymorphic engine

Native C evasion framework — AES-256-CBC, 5 syscall methods, 8 injection techniques, HW breakpoint AMSI/ETW bypass

AD attack chain automator — 17 modules, persistent credential store, adaptive attack graph, goal-seeking engine

26 scripts (13 modules) covering full AD attack lifecycle — CAPE-based, tested on 3 HTB machines

Network telemetry analysis and correlation engine — modular parsers, analyzers, correlators, reporters

AI-powered threat detection framework — modular collectors, detectors, and analyzers

C#/.NET AV evasion payload generator — Mono/csc.exe compilation, P/Invoke obfuscation

Linux RAT — reverse TCP C2, remote shell, file transfer, cron persistence, XOR-obfuscated protocol

Simple malware generator CLI — XOR encoding, C templates, MinGW compilation

Persistent shell session manager — SSH, reverse listeners, shell upgrades, tunnel pivoting via MCP