Official Black Hat Arsenal Security Tools Repository
-
Updated
Jun 2, 2021
Added automatic duplicate rules detection in PR, so that Quark rules repo can detect whether there are duplicate rules when PR is sent. It could be the Github Action or Travis ci integration.
Add a description, image, and links to the blackhat topic page so that developers can more easily learn about it.
To associate your repository with the blackhat topic, visit your repo's landing page and select "manage topics."
Current implementation of
proclist
plugin useswin32_ps_list_procs()
php function on Windows host.Therefore, linux implementation is a simple
system("ps -a")
, which is OPSEC unsafe, an would probably trigger EDR alerts.A better implementation should avoid relying on system command execution.