BYOVD hunter to help prioritize windows drivers worth manual analysis
☆125Aug 19, 2025Updated 6 months ago
Alternatives and similar repositories for HolyGrail
Users that are interested in HolyGrail are comparing it to the libraries listed below
Sorting:
- Awesome MalDev Links☆41Updated this week
- A different approach to writing BOFs in rust.☆19Aug 20, 2025Updated 6 months ago
- Terminate AV/EDR processes by exploiting the vulnerable NsecSoft driver☆33Sep 15, 2025Updated 5 months ago
- A Rust PoC implementation of the Early Bird process hollowing technique, inspired by https://github.com/boku7/HOLLOW.☆31Feb 7, 2025Updated last year
- Cross Compatible Command and Control☆47Dec 18, 2025Updated 2 months ago
- Alternative Read and Write primitives using Rtl* functions the unintended way.☆79Aug 25, 2025Updated 6 months ago
- GPOAnalyzer is a tool designed to assist in parsing domain Group Policy Object (GPO) files located in the SYSVOL directory.☆28Jun 14, 2024Updated last year
- Random BOFs for LDAP tradecraft☆74Sep 9, 2025Updated 6 months ago
- Crystal Palace RDLL loader for Adaptix C2 with Ekko sleep obfuscation, IAT hooking via PICO, and per-section permission restoration☆75Feb 28, 2026Updated last week
- Use the Netlogon Remote Protocol (MS-NRPC) to dump the target hash.☆62Feb 25, 2025Updated last year
- Thats it! An Open-Source Windows UEFI Rootkit☆28Jul 19, 2025Updated 7 months ago
- Dynamically invoke arbitrary code in Rust☆101Updated this week
- string encryption in Nim☆20Jun 15, 2024Updated last year
- An advanced utility for converting Windows Portable Executable (PE) files to position-independent code (PIC) shellcode. It enables execut…☆65Mar 1, 2025Updated last year
- ☆33Mar 19, 2025Updated 11 months ago
- A BOF that suspends non-GUI threads for a target process or resumes them resulting in stealthy process silencing.☆57Apr 14, 2025Updated 10 months ago
- ☆26Aug 11, 2025Updated 6 months ago
- Structured CSVs and table schemas extracted from the 29-April-2025 LockBit affiliate-panel database leak.☆28May 8, 2025Updated 10 months ago
- Locate dlls and function addresses without PEB Walk and EAT parsing☆105Nov 7, 2025Updated 4 months ago
- A modern Rust implementation of the original Stardust project, providing a sophisticated 32/64-bit shellcode template that features posit…☆59Mar 17, 2025Updated 11 months ago
- A pointer encryption library intended for Red Team implant design in Rust.☆66Oct 1, 2025Updated 5 months ago
- Generate DLL proxy/sideload projects. Automatically parses PE export tables and generates ready-to-compile project for red team engagemen…☆112Updated this week
- A Rust version of Mirage, a PoC memory evasion technique that relies on a vulnerable VBS enclave to hide shellcode within VTL1.☆38Mar 6, 2025Updated last year
- converts sRDI compatible dlls to shellcode☆35Jan 20, 2025Updated last year
- Collection of red team techniques.☆68Apr 25, 2025Updated 10 months ago
- Shellcode loader that executes embedded Lua from Rust.☆127Dec 16, 2024Updated last year
- Mythic C2 wrapper for NimSyscallPacker☆25Mar 12, 2025Updated 11 months ago
- remote process injections using pool party techniques☆70Jun 29, 2025Updated 8 months ago
- Terms of Use Conditional Access M365 Evilginx Phishlet☆44Jun 23, 2025Updated 8 months ago
- StealthGuardian is a middleware layer that can be combined with adversary simulation tools to verify the resistance, detection level and…☆20Aug 7, 2024Updated last year
- find dll base addresses without PEB WALK☆161Jul 13, 2025Updated 7 months ago
- NyxInvoke is a Rust CLI tool for running .NET assemblies, PowerShell, and BOFs with Patchless AMSI and ETW bypass features. with Dual-bui…☆234Feb 12, 2025Updated last year
- lolC2 is a collection of C2 frameworks that leverage legitimate services to evade detection☆259Jan 29, 2026Updated last month
- .NET profiler DLL loading can be abused to make a legit .NET application load a malicious DLL using environment variables. This exploit i…☆46Jul 29, 2024Updated last year
- ☆33Jan 23, 2025Updated last year
- A cross platform C2/post-exploitation framework☆55Nov 2, 2025Updated 4 months ago
- Slides for COM Hijacking AV/EDR Talk on 38c3☆75Jan 3, 2025Updated last year
- A PowerShell console in C/C++ with all the security features disabled☆368Oct 14, 2025Updated 4 months ago
- Cobaltstrike Reflective Loader with Synthetic Stackframe☆188Jan 17, 2026Updated last month