3gstudent / ntfsDump
Use to copy a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures.
☆111Updated 3 years ago
Related projects ⓘ
Alternatives and complementary repositories for ntfsDump
- ☆106Updated last year
- Implant drop-in for EDR testing☆128Updated last year
- ☆128Updated 2 years ago
- ☆133Updated last year
- ☆61Updated 2 years ago
- Patch AMSI and ETW in remote process via direct syscall☆77Updated 2 years ago
- Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged☆86Updated 2 years ago
- Tool for playing with Windows Access Token manipulation.☆52Updated last year
- I have documented all of the AMSI patches that I learned till now☆68Updated last year
- ☆73Updated last year
- RDLL for Cobalt Strike beacon to silence sysmon process☆85Updated 2 years ago
- It's pointy and it hurts!☆122Updated 2 years ago
- Section Mapping Process Injection (secinject): Cobalt Strike BOF☆87Updated 2 years ago
- C# version of NTLMRawUnHide☆72Updated 2 years ago
- Simple BOF to read the protection level of a process☆104Updated last year
- ☆139Updated last year
- Proof of concept Beacon Object File (BOF) that attempts to detect userland hooks in place by AV/EDR☆97Updated 3 years ago
- Beacon Object File allowing creation of Beacons in different sessions.☆76Updated 2 years ago
- A basic emulation of an "RPC Backdoor"☆208Updated 2 years ago
- A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge …☆164Updated last year
- Utilizing hardware breakpoints to evade monitoring by Endpoint Detection and Response platforms☆111Updated last year
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆120Updated last year
- ☆108Updated last year
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆51Updated last year
- Overwrite a process's recovery callback and execute with WER☆102Updated 2 years ago