0xflux / Sanctum
Sanctum is a proof-of-concept EDR like tool, designed to detect modern malware techniques, above and beyond the capabilities of antivirus. Built in Rust.
☆22Updated this week
Alternatives and similar repositories for Sanctum:
Users that are interested in Sanctum are comparing it to the libraries listed below
- "Service-less" driver loading☆149Updated 2 months ago
- Rust For Windows Cheatsheet☆115Updated 3 months ago
- Dirty PoC on how to abuse S1's VEH for Vectored Syscalls and Local Execution☆41Updated 6 months ago
- A collection of position independent coding resources☆64Updated last week
- ☆46Updated last year
- A improved memory obfuscation primitive using a combination of special and 'normal' Asynchronous Procedural Calls☆105Updated 4 months ago
- Malware?☆69Updated 3 months ago
- LKM rootkit for modern kernels, with DNS C2 and a simple web interface☆63Updated last week
- 32bit MIPS I VM to execute payloads without allocating executable memory. Based on a PlayStation 1 (PSX) Emulator.☆105Updated last month
- DLL proxying for lazy people☆148Updated last month
- 64-bit, position-independent implant template for Windows in Rust.☆108Updated 3 months ago
- A cmkr based win32 shellcode template for a unified build platform and more production friendly structure/testing.☆66Updated 2 months ago
- A Rust port of LayeredSyscall — performs indirect syscalls while generating legitimate API call stack frames by abusing VEH.☆132Updated 3 months ago
- This is the combination of multiple evasion techniques to evade defenses. (Dirty Vanity)☆46Updated 8 months ago
- Activation Context Hijack☆141Updated 2 months ago
- ☆103Updated 3 months ago
- Windows rootkit designed to work with BYOVD exploits☆144Updated last week
- Shellcode loader that executes embedded Lua from Rust.☆82Updated last month
- Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections☆111Updated last year
- A python polymorphic engine for C programs☆12Updated last year
- early cascade injection PoC based on Outflanks blog post, in rust☆50Updated 2 months ago
- Nim process hollowing loader☆49Updated 5 months ago
- Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)☆95Updated last year
- Proof of concept demonstrating a method of proxying syscalls indirectly☆8Updated 6 months ago
- malleable profile generator GUI for Havoc☆56Updated last year
- a modified CONTEXT based ropchain to circumvent CFG-FindHiddenShellcode and EtwTi-FluctuationMonitor☆96Updated 10 months ago
- Sleep obfuscation☆206Updated last month
- ☆88Updated 2 weeks ago
- Detect EDR's exceptions by inspecting processes' loaded modules☆124Updated 10 months ago