Alternatives and similar repositories for Sanctum

Users that are interested in Sanctum are comparing it to the libraries listed below

• dobin / RedEdr
  Collect Windows telemetry for Maldev
  ☆429Updated last month
• memN0ps / venom-rs
  Rusty Injection - Shellcode Reflective DLL Injection (sRDI) in Rust (Codename: Venom)
  ☆352Updated last year
• Kudaes / Shelter
  ROP-based sleep obfuscation to evade memory scanners
  ☆365Updated 4 months ago
• janoglezcampos / rust_syscalls
  Single stub direct and indirect syscalling with runtime SSN resolving for windows.
  ☆226Updated 2 years ago
• BlackSnufkin / BYOVD
  BYOVD research use cases featuring vulnerable driver discovery and reverse engineering methodology. (CVE-2025-52915, CVE-2025-1055,).
  ☆402Updated last week
• joaoviictorti / uwd
  Call Stack Spoofing for Rust
  ☆192Updated last week
• vxCrypt0r / Voidmaw
  A new technique that can be used to bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders imp…
  ☆330Updated last year
• klezVirus / DriverJack
  Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths
  ☆352Updated last year
• hasherezade / thread_namecalling
  Process Injection using Thread Name
  ☆282Updated 6 months ago
• DualHorizon / blackpill
  A Linux kernel rootkit in Rust using a custom made type-2 hypervisor, eBPF XDP and TC programs
  ☆331Updated 4 months ago
• jstrosch / sclauncher
  A small program written in C that is designed to load 32/64-bit shellcode and allow for execution or debugging. Can also output PE files …
  ☆165Updated last year
• Kudaes / Unwinder
  Call stack spoofing for Rust
  ☆347Updated 8 months ago
• EgeBalci / deoptimizer
  Evasion by machine code de-optimization.
  ☆408Updated last year
• Kudaes / DInvoke_rs
  Dynamically invoke arbitrary unmanaged code
  ☆357Updated 11 months ago
• kleiton0x00 / Proxy-DLL-Loads
  A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.
  ☆358Updated 8 months ago
• tijme / dittobytes
  Metamorphic cross-compilation of C++ & C-code to PIC, BOF & EXE.
  ☆537Updated last month
• V-i-x-x / kernel-callback-removal
  kernel callback removal (Bypassing EDR Detections)
  ☆195Updated 7 months ago
• rtecCyberSec / Packer_Development
  Slides & Code snippets for a workshop held @ x33fcon 2024
  ☆271Updated last year
• Unprotect-Project / Unprotect_Submission
  Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in thi…
  ☆196Updated last month
• janoglezcampos / llvm-yx-callobfuscator
  LLVM plugin to transparently apply stack spoofing and indirect syscalls to Windows x64 native calls at compile time.
  ☆315Updated last year
• Kudaes / Fiber
  Using fibers to run in-memory code.
  ☆220Updated 2 years ago
• Bw3ll / sharem
  SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also conta…
  ☆466Updated 4 months ago
• 0xflux / Rust-Hells-Gate
  Rust malware EDR evasion via direct syscalls, fully implemented as an example in Rust
  ☆70Updated last year
• Azr43lKn1ght / Rusty-PE-Packer
  ☆32Updated 9 months ago
• daem0nc0re / VectorKernel
  PoCs for Kernelmode rootkit techniques research.
  ☆409Updated last month
• BlackSnufkin / Rusty-Playground
  Some Rust program I wrote while learning Malware Development
  ☆149Updated 8 months ago
• Kudaes / MFTool
  Direct access to NTFS volumes
  ☆280Updated last month
• hasherezade / waiting_thread_hijacking
  Waiting Thread Hijacking - injection by overwriting the return address of a waiting thread
  ☆245Updated last month
• MrAle98 / CVE-2025-21333-POC
  POC exploit for CVE-2025-21333 heap-based buffer overflow. It leverages WNF state data and I/O ring IOP_MC_BUFFER_ENTRY
  ☆221Updated 6 months ago
• Kudaes / EPI
  Threadless Process Injection through entry point hijacking
  ☆348Updated last year