0x00Check / Amaterasu
Amaterasu terminates, or inhibits, protected processes such as application control and AV/EDR solutions by leveraging the Sysinternals Process Explorer driver to kill a process's handles from kernel mode.
☆71Updated last year
Alternatives and similar repositories for Amaterasu:
Users that are interested in Amaterasu are comparing it to the libraries listed below
- ☆47Updated last year
- ☆91Updated 3 years ago
- CLIPBRDWNDCLASS process injection technique(BOF) - execute beacon shellcode in callback☆68Updated 2 years ago
- Evasive loader to bypass static detection☆58Updated last year
- Efficient RAT signature locator for bypassing AV/EDR, supporting static scanning and memory scanning.☆38Updated 6 months ago
- AdaptixFramework Extension Kit☆60Updated this week
- more conveniently Visual-Studio-BOF-template☆63Updated last year
- ☆96Updated last year
- Shellcode Reductio Entropy Tools☆66Updated last year
- Exploit for CVE-2023-36802 targeting MSKSSRV.SYS driver☆112Updated last year
- Load shellcode via syscall☆53Updated 3 years ago
- vehsyscall:a syscall project that may bypass EDR☆56Updated last year
- Beacon compiled using clang☆66Updated 2 years ago
- Alternative Shellcode Execution Via Callbacks Rewrite In C#☆88Updated last year
- It stinks☆102Updated 3 years ago
- A Cobalt Strike memory evasion loader for redteamers☆99Updated 2 years ago
- CSharp reimplementation of Venoma, another C++ Cobalt Strike beacon dropper with custom indirect syscalls execution☆42Updated last year
- Use COM Component Bypass UAC,Dll Version☆34Updated 4 years ago
- An implementation of an indirect system call☆126Updated last year
- ☆26Updated last year
- Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique☆63Updated 2 years ago
- Help red teams find opsec processes during engagements☆38Updated 4 months ago
- ☆22Updated last year
- use aswArPot.sys to kill process☆67Updated 2 years ago
- Take a screenshot without injection for Cobalt Strike☆186Updated last year
- A Simple PoC☆21Updated 11 months ago
- ☆40Updated last year
- Dumping LSASS with a duplicated handle from custom LSA plugin☆200Updated 3 years ago
- frida based script which automates the process of discovering and exploiting DLL Hijacks in target binaries. The discovered binaries can …☆51Updated 2 years ago
- A simple Sleepmask BOF example☆98Updated 7 months ago