diff --git a/Offensive.md b/Offensive.md
index 976481e..0a2497e 100644
--- a/Offensive.md
+++ b/Offensive.md
@@ -1064,6 +1064,10 @@ Some tools can be categorized in more than one category. But because the current
EspressoCake/Toggle_Token_Privileges_BOF |
Syscall BOF to arbitrarily add/detract process token privilege rights. |
+
+ GhostPack/Certify |
+ Active Directory certificate abuse. |
+
GhostPack/ForgeCert |
ForgeCert uses the BouncyCastle C# API and a stolen Certificate Authority (CA) certificate + private key to forge certificates for arbitrary users capable of authentication to Active Directory. |
@@ -1334,6 +1338,10 @@ Some tools can be categorized in more than one category. But because the current
Flangvik/RosFuscator |
YouTube/Livestream project for obfuscating C# source code using Roslyn |
+
+ GetRektBoy724/SharpUnhooker |
+ C# Based Universal API Unhooker |
+
GetRektBoy724/TripleS |
Syscall Stub Stealer - Freshly steal Syscall stub straight from the disk |
@@ -2009,10 +2017,6 @@ Some tools can be categorized in more than one category. But because the current
FuzzySecurity/StandIn |
StandIn is a small .NET35/45 AD post-exploitation toolkit |
-
- GhostPack/Certify |
- Active Directory certificate abuse. |
-
improsec/ImproHound |
Identify the attack paths in BloodHound breaking your AD tiering |