Skip to content

Latest commit

 

History

History
9 lines (5 loc) · 423 Bytes

README.md

File metadata and controls

9 lines (5 loc) · 423 Bytes

Windows ShadowMove Socket Duplication

Description

The tool (/POC) is a simple programming exercise in order to replicate the socket duplication technique explained in ShadowMove: A Stealthy Lateral Movement Strategy.

My purpose for this tool was to trigger events that can be monitored / logged and later used for endpoint detection.