0xflux / SanctumLinks
Sanctum is an experimental proof-of-concept EDR, designed to detect modern malware techniques, above and beyond the capabilities of antivirus. Built in Rust.
☆251Updated last week
Alternatives and similar repositories for Sanctum
Users that are interested in Sanctum are comparing it to the libraries listed below
Sorting:
- Rusty Injection - Shellcode Reflective DLL Injection (sRDI) in Rust (Codename: Venom)☆339Updated last year
- ROP-based sleep obfuscation to evade memory scanners☆359Updated last month
- Call Stack Spoofing for Rust☆187Updated 3 weeks ago
- Single stub direct and indirect syscalling with runtime SSN resolving for windows.☆220Updated 2 years ago
- Rust For Windows Cheatsheet☆121Updated 9 months ago
- Collect Windows telemetry for Maldev☆379Updated last week
- Dynamically invoke arbitrary unmanaged code☆348Updated 8 months ago
- Rust malware EDR evasion via direct syscalls, fully implemented as an example in Rust☆62Updated last year
- kernel callback removal (Bypassing EDR Detections)☆183Updated 4 months ago
- Some Rust program I wrote while learning Malware Development☆137Updated 6 months ago
- Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths☆349Updated 11 months ago
- Call stack spoofing for Rust☆339Updated 5 months ago
- A new technique that can be used to bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders imp…☆319Updated 9 months ago
- LLVM plugin to transparently apply stack spoofing and indirect syscalls to Windows x64 native calls at compile time.☆296Updated last year
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆350Updated 5 months ago
- Process Injection using Thread Name☆274Updated 3 months ago
- Slides & Code snippets for a workshop held @ x33fcon 2024☆261Updated last year
- Waiting Thread Hijacking - injection by overwriting the return address of a waiting thread☆227Updated 2 months ago
- ☆14Updated 6 months ago
- Tools for analyzing EDR agents☆238Updated last year
- DLL proxying for lazy people☆177Updated last month
- Using fibers to run in-memory code.☆216Updated last year
- Memory Obfuscation in Rust☆235Updated last week
- Some POCs for my BYOVD research and find some vulnerable drivers☆293Updated 2 weeks ago
- ☆193Updated last year
- Threadless Process Injection through entry point hijacking☆347Updated 10 months ago
- Rusty Arsenal - A collection of experimental Process Injection and Post-Exploitation Techniques in Rust☆272Updated last year
- Windows rootkit designed to work with BYOVD exploits☆204Updated 6 months ago
- A Rust port of LayeredSyscall — performs indirect syscalls while generating legitimate API call stack frames by abusing VEH.☆152Updated 9 months ago
- A small program written in C that is designed to load 32/64-bit shellcode and allow for execution or debugging. Can also output PE files …☆155Updated last year