CheckPointSW / EvasionsLinks
Evasions encyclopedia gathers methods used by malware to evade detection when run in virtualized environment. Methods are grouped into categories for ease of searching and understanding. Also provided are code samples, signature recommendations and countermeasures within each category for the described techniques.
☆408Updated 10 months ago
Alternatives and similar repositories for Evasions
Users that are interested in Evasions are comparing it to the libraries listed below
Sorting:
- Anti-virus artifacts. Listing APIs hooked by: Avira, BitDefender, F-Secure, MalwareBytes, Norton, TrendMicro, and WebRoot.☆740Updated 3 years ago
- A Windows kernel-mode rootkit that abuses legitimate communication channels to control a machine.☆702Updated 4 years ago
- Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs☆750Updated last year
- Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the in…☆1,140Updated last year
- My implementation of enSilo's Process Doppelganging (PE injection technique)☆610Updated 2 years ago
- Dynamic unpacker based on PE-sieve☆732Updated last week
- Expriments☆458Updated 8 months ago
- ☆752Updated last year
- Quickly debug shellcode extracted during malware analysis☆602Updated 2 years ago
- ☆472Updated 2 years ago
- Enumerate and disable common sources of telemetry used by AV/EDR.☆797Updated 4 years ago
- Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted fi…☆660Updated last year
- Project for identifying executables and DLLs vulnerable to relative path DLL hijacking.☆467Updated last year
- ☆814Updated 5 years ago
- Live hunting of code injection techniques☆382Updated 5 years ago
- A method of bypassing EDR's active projection DLL's by preventing entry point exection☆1,144Updated 4 years ago
- LSASS memory dumper using direct system calls and API unhooking.☆1,533Updated 4 years ago
- Evasive shellcode loader for bypassing event-based injection detection (PoC)☆776Updated 3 years ago
- A modular C2 framework☆471Updated last month
- Sleep Obfuscation☆760Updated last year
- Small and convenient C2 tool for Windows targets. [ Русский -- значит нахуй! ]☆606Updated 3 years ago
- PeaceMaker Threat Detection is a Windows kernel-based application that detects advanced techniques used by malware.☆420Updated 5 years ago
- AV/EDR evasion via direct system calls.☆1,880Updated 2 years ago
- collect for learning cases☆584Updated 11 months ago
- Tool to bypass LSA Protection (aka Protected Process Light)☆946Updated 2 years ago
- Original C Implementation of the Hell's Gate VX Technique☆1,051Updated 3 years ago
- Virus Exchange (VX) - Collection of malware or assembly code used for "offensive" purposed.☆180Updated 3 years ago
- Extract Windows Defender database from vdm files and unpack it☆440Updated 5 years ago
- Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)☆812Updated 3 years ago
- ☆298Updated 4 years ago