Yeah, it would be awesome to do a kind of semi-automated controlled detonation like that! So cool for purple teaming.

Anyway, simple little shared library for Crystal Palace to unit test your PICOs - coming soon!

For example! I want a way to generate adozen almost-identical implants that all use slightly different tradecraft to achieve their goals, then run them all against a VM snapshot with an EDR agent installed and see which ones generate detections and why.

Just got a chance to try it out, works like a charm!

This is super cool! I'm guessing it'll only work on x64 due to the assembly used for the callback, right?

And it's released! 🎉

github.com/ofasgard/exe...

I've tested it with Rubeus and Seatbelt and a variety of different arguments, and it seems to be pretty stable as far as I can tell. If anyone uses this PICO and encounters bugs or instability, please let me know!