0xTriboulet / T-1Links
T-1 is a shellcode loader that leverages ML techniques to detect VM environments
☆32Updated 9 months ago
Alternatives and similar repositories for T-1
Users that are interested in T-1 are comparing it to the libraries listed below
Sorting:
- early cascade injection PoC based on Outflanks blog post, in rust☆60Updated 9 months ago
- Shellcode Loader Utilizing ETW Events☆64Updated 5 months ago
- Hunting and injecting RWX 'mockingjay' DLLs in pure nim☆59Updated 7 months ago
- A stealthy, assembly-based tool for secure function address resolution, offering a robust alternative to GetProcAddress.☆73Updated last year
- Proxy function calls through the thread pool with ease☆28Updated 5 months ago
- Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.☆62Updated last year
- A modern Rust implementation of the original Stardust project, providing a sophisticated 32/64-bit shellcode template that features posit…☆57Updated 4 months ago
- A collection of position independent coding resources☆89Updated 5 months ago
- Demoting PPL anti-malware services to less than a guest user☆64Updated 6 months ago
- Windows NTLM hash dump utility written in C language, that supports Windows and Linux. Hashes can be dumped in realtime or from already s…☆63Updated last year
- Indirect Syscall implementation to bypass userland NTAPIs hooking.☆76Updated 11 months ago
- A process injection technique using only thread context manipulation☆37Updated last year
- Section-based payload obfuscation technique for x64☆64Updated last year
- Post-Ex BOF tooling for Hannibal☆24Updated 8 months ago
- shell code example☆61Updated 2 months ago
- Dll injection through code page id modification in registry. Based on jonas lykk research☆17Updated 3 years ago
- Dirty PoC on how to abuse S1's VEH for Vectored Syscalls and Local Execution☆42Updated last year
- ☆35Updated 7 months ago
- ☆72Updated 6 months ago
- ☆87Updated 11 months ago
- a demo module for the kaine agent to execute and inject assembly modules☆39Updated 11 months ago
- BOF for C2 framework☆41Updated 9 months ago
- Rewrite to fit my needs☆30Updated last year
- Mirage is a PoC memory evasion technique that relies on a vulnerable VBS enclave to hide shellcode within VTL1.☆92Updated 5 months ago
- ☆107Updated 9 months ago
- Linker for Beacon Object Files☆124Updated 3 weeks ago
- A truly Position Independent Code (PIC) NimPlant C2 beacon written in C, without reflective loading.☆61Updated 5 months ago
- Shellcode loader using direct syscalls via Hell's Gate and payload encryption.☆91Updated last year
- Identifies LOLDrivers that are not blocked by the active HVCI policy — ideal for BYOVD scenarios.☆60Updated 2 weeks ago
- Cortex EDR Ransomware protection Bypass☆25Updated 6 months ago