diff --git a/Offensive.md b/Offensive.md
index 908665c..34a74ff 100644
--- a/Offensive.md
+++ b/Offensive.md
@@ -535,6 +535,10 @@ Some tools can be categorized in more than one category. But because the current
airzero24/PortMonitorPersist |
PoC for Port Monitor Persistence |
+
+ ben0xa/doucme |
+ This leverages the NetUserAdd Win32 API to create a new computer account. This is done by setting the usri1_priv of the USER_INFO_1 type to 0x1000. The primary goal is to avoid the normal detection of new user created events (4720). |
+
fireeye/SharPersist |
Windows persistence toolkit written in C#. |