Ne0nd0g

Tools like JA3 https://github.com/salesforce/ja3 can fingerprint TLS traffic to provide one way to perform some type of evaluation. Defender can detect on a lot of other things like an applications behavior.

Thanks!

Yeah, that part is frustrating. It picks up the PowerShell script in one of the sub directories and marks the whole project as such.

I make most of my commits to the Dev branch and I am selective about pushing things to the Master branch. Check the releases page for a good indication of activity. I will also be pushing out an update in the next couple of days that adds the ability to execute shellcode using 4 different methods (Windows only).