0x00Check / Amaterasu
Amaterasu terminates, or inhibits, protected processes such as application control and AV/EDR solutions by leveraging the Sysinternals Process Explorer driver to kill a process's handles from kernel mode.
☆71Updated last year
Alternatives and similar repositories for Amaterasu:
Users that are interested in Amaterasu are comparing it to the libraries listed below
- ☆46Updated 11 months ago
- ☆91Updated 3 years ago
- Beacon compiled using clang☆63Updated 2 years ago
- Alternative Shellcode Execution Via Callbacks Rewrite In C#☆88Updated last year
- Shellcode Reductio Entropy Tools☆64Updated last year
- Evasive loader to bypass static detection☆57Updated last year
- CLIPBRDWNDCLASS process injection technique(BOF) - execute beacon shellcode in callback☆68Updated 2 years ago
- vehsyscall:a syscall project that may bypass EDR☆54Updated last year
- Load shellcode via syscall☆47Updated 3 years ago
- more conveniently Visual-Studio-BOF-template☆61Updated last year
- It stinks☆101Updated 2 years ago
- Efficient RAT signature locator for bypassing AV/EDR, supporting static scanning and memory scanning.☆33Updated 4 months ago
- Exploit for CVE-2023-36802 targeting MSKSSRV.SYS driver☆113Updated last year
- A Cobalt Strike memory evasion loader for redteamers☆98Updated 2 years ago
- ☆26Updated last year
- ☆40Updated last year
- Beacon Object File implementation of pwn1sher's KillDefender☆66Updated 2 years ago
- Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique☆62Updated 2 years ago
- beta☆114Updated 5 months ago
- Take a screenshot without injection for Cobalt Strike☆182Updated last year
- Binary Hollowing☆70Updated 6 months ago
- Section Mapping Process Injection modified with SysWhisper2 (sw2-secinject): Cobalt Strike BOF☆41Updated 2 years ago
- Dumping LSASS with a duplicated handle from custom LSA plugin☆199Updated 3 years ago
- frida based script which automates the process of discovering and exploiting DLL Hijacks in target binaries. The discovered binaries can …☆51Updated last year
- CSharp reimplementation of Venoma, another C++ Cobalt Strike beacon dropper with custom indirect syscalls execution☆42Updated 10 months ago
- use aswArPot.sys to kill process☆67Updated 2 years ago
- ReturnGate, just like HellsGate.☆66Updated 2 years ago
- Help red teams find opsec processes during engagements☆26Updated 3 months ago
- ☆96Updated last year
- Cobalt Strike BOF that Add a user to localgroup by samr☆126Updated 2 years ago