WithSecureLabs/doublepulsar-detection-script

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1030 stars · 308 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Python 2 script that sweeps networks to detect Windows systems compromised with the DOUBLEPULSAR implant (SMB and RDP variants) released by the Shadow Brokers. It re-implements the implant's unauthenticated ping command and can remotely uninstall the SMB version for remediation.

Use cases

• detect doublepulsar implant on my network
• scan ip range for smb backdoor
• check if windows servers are compromised by eternalblue implant
• remotely uninstall doublepulsar from infected hosts
• sweep list of ips for rdp implant
• incident response network compromise detection

When to choose

• you need to quickly check whether Windows hosts on your network are infected with DOUBLEPULSAR
• you want a lightweight scriptable scanner with multi-threaded IP list support
• you need to remotely remove the SMB variant of the implant

When to avoid

• you need a general-purpose vulnerability scanner rather than a DOUBLEPULSAR-specific check
• your environment requires Python 3 - the scripts are Python 2 only
• you need ongoing maintenance or support for newer Windows versions, as the project is no longer actively developed

Facets

cli-tool · maturity maintenance

security vulnerability-scanning networking security penetration-testing networking windows windows cli python doublepulsar shadow-brokers smb rdp network-sweep implant-detection python2 incident-response linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="WithSecureLabs/doublepulsar-detection-script")