0x00Check / AmaterasuLinks
Amaterasu terminates, or inhibits, protected processes such as application control and AV/EDR solutions by leveraging the Sysinternals Process Explorer driver to kill a process's handles from kernel mode.
☆72Updated last year
Alternatives and similar repositories for Amaterasu
Users that are interested in Amaterasu are comparing it to the libraries listed below
Sorting:
- ☆47Updated last year
- Alternative Shellcode Execution Via Callbacks Rewrite In C#☆88Updated 2 years ago
- CLIPBRDWNDCLASS process injection technique(BOF) - execute beacon shellcode in callback☆69Updated 2 years ago
- Load shellcode via syscall☆54Updated 3 years ago
- more conveniently Visual-Studio-BOF-template☆65Updated last year
- ☆91Updated 3 years ago
- Beacon compiled using clang☆69Updated 2 years ago
- vehsyscall:a syscall project that may bypass EDR☆59Updated last year
- Beacon Object File implementation of pwn1sher's KillDefender☆66Updated 2 years ago
- ☆95Updated last year
- Shellcode Reductio Entropy Tools☆67Updated last year
- ☆26Updated last year
- Evasive loader to bypass static detection☆60Updated last year
- Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique☆63Updated 2 years ago
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆49Updated last year
- Exploit for CVE-2023-36802 targeting MSKSSRV.SYS driver☆112Updated last year
- Binary Hollowing☆76Updated 8 months ago
- Take a screenshot without injection for Cobalt Strike☆190Updated last year
- Cobalt Strike BOF that Add an admin user☆73Updated 2 years ago
- An implementation of an indirect system call☆127Updated last year
- Exploits undocumented elevated COM interface ICMLuaUtil via process spoofing to edit registry then calls ColorDataProxy to trigger UAC b…☆138Updated 2 years ago
- A wrapper of ldap_shell.py module which in ntlmrelayx☆62Updated 2 years ago
- A simple Sleepmask BOF example☆101Updated 9 months ago
- Cobalt Strike Beacon Object File (BOF) that obtain SYSTEM privilege with SeImpersonate privilege by passing a malicious IUnknwon object t…☆49Updated 2 years ago
- use aswArPot.sys to kill process☆67Updated 2 years ago
- Dumping LSASS with a duplicated handle from custom LSA plugin☆201Updated 3 years ago
- Cobalt Strike BOF that Add a user to localgroup by samr☆129Updated 2 years ago
- It stinks☆102Updated 3 years ago
- ☆40Updated last year
- BOF implementation of delete self poc that delete a locked executable or a currently running file from disk by its pid, path, or the curr…☆74Updated last year