BlackShell256 / Null-AMSI
Null-AMSI is an AMSI and ETW bypass that takes advantage of .NET types (.NET Reflection) to bypassing AV/EDR.
☆50Updated last week
Alternatives and similar repositories for Null-AMSI:
Users that are interested in Null-AMSI are comparing it to the libraries listed below
- This is way to load a shellcode, and obfuscate it, so it avoids scantime detection.☆60Updated 9 months ago
- Inject RDPThief into memory with PowerShell.☆62Updated 2 months ago
- Malicious powershell scripts loader designed to avoid detection.☆51Updated last year
- .bin file to shellcode convertor☆34Updated 9 months ago
- Construct the payload at runtime using an array of offsets☆63Updated 9 months ago
- Just another C2 Redirector using CloudFlare. Support multiple C2 and multiple domains. Support for websocket listener.☆153Updated last month
- ☆66Updated last month
- TeamServer and Client of Exploration Command and Control Framework☆122Updated 2 weeks ago
- Morpheus is a memory dumper that extracts lsass.exe in RAM and exfiltrates it via forged NTP packets. It uses RC4 encryption and Reed-Sol…☆88Updated last week
- 「💀」Proof of concept on BYOVD attack☆157Updated 4 months ago
- Create Anti-Copy DRM Malware☆55Updated 7 months ago
- Leverage WindowsApp createdump tool to obtain an lsass dump☆147Updated 6 months ago
- DebugAmsi is another way to bypass AMSI through the Windows process debugger mechanism.☆96Updated last year
- NoArgs is a tool designed to dynamically spoof and conceal process arguments while staying undetected. It achieves this by hooking into W…☆151Updated 11 months ago
- NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg☆46Updated last year
- Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks☆103Updated 3 months ago
- A Mythic agent for Windows written in C☆115Updated last week
- Identify common EDR processes, directories, and services. Simple BOF of Invoke-EDRChecker.☆119Updated 6 months ago
- comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reducti…☆197Updated 10 months ago
- ☆152Updated 8 months ago
- WTSImpersonator utilizes WTSQueryUserToken to steal user tokens by abusing the RPC Named Pipe "\\pipe\LSM_API_service"☆118Updated 9 months ago
- Indirect Syscall implementation to bypass userland NTAPIs hooking.☆74Updated 8 months ago
- this script adds the ability to encode shellcode (.bin) in XOR,chacha20, AES. You can choose between 2 loaders (Myph / 221b)☆82Updated last year
- This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone…☆196Updated 5 months ago
- PowerShell Reverse Shell☆61Updated last year
- Evasive Golang Loader☆131Updated 8 months ago
- Adversary Emulation Framework☆96Updated 8 months ago
- ☆106Updated 2 months ago
- Two in one, patch lifetime powershell console, no more etw and amsi!☆86Updated 9 months ago
- Example code samples from our ScriptBlock Smuggling Blog post☆90Updated 10 months ago