CheckPointSW / EvasionsLinks
Evasions encyclopedia gathers methods used by malware to evade detection when run in virtualized environment. Methods are grouped into categories for ease of searching and understanding. Also provided are code samples, signature recommendations and countermeasures within each category for the described techniques.
☆431Updated last year
Alternatives and similar repositories for Evasions
Users that are interested in Evasions are comparing it to the libraries listed below
Sorting:
- Anti-virus artifacts. Listing APIs hooked by: Avira, BitDefender, F-Secure, MalwareBytes, Norton, TrendMicro, and WebRoot.☆748Updated 3 years ago
- Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs☆777Updated last year
- Enumerate and disable common sources of telemetry used by AV/EDR.☆811Updated 4 years ago
- Expriments☆473Updated last year
- My implementation of enSilo's Process Doppelganging (PE injection technique)☆627Updated 3 years ago
- A Windows kernel-mode rootkit that abuses legitimate communication channels to control a machine.☆711Updated 5 years ago
- Virus Exchange (VX) - Collection of malware or assembly code used for "offensive" purposed.☆190Updated 2 months ago
- Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted fi…☆669Updated last year
- Extract Windows Defender database from vdm files and unpack it☆466Updated 2 months ago
- Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the in…☆1,161Updated 2 years ago
- Quickly debug shellcode extracted during malware analysis☆612Updated 2 years ago
- Dynamic unpacker based on PE-sieve☆774Updated last month
- Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)☆584Updated last year
- Small and convenient C2 tool for Windows targets. [ Русский -- значит нахуй! ]☆614Updated 3 years ago
- ☆301Updated 4 years ago
- PeaceMaker Threat Detection is a Windows kernel-based application that detects advanced techniques used by malware.☆427Updated 5 years ago
- ☆820Updated 5 years ago
- ☆478Updated 2 years ago
- Evade sysmon and windows event logging☆625Updated 5 years ago
- Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers t…☆458Updated 4 years ago
- Project for identifying executables and DLLs vulnerable to relative path DLL hijacking.☆476Updated last year
- Live hunting of code injection techniques☆383Updated 6 years ago
- A modular C2 framework☆492Updated this week
- Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)☆824Updated 3 years ago
- Research on Anti-malware and other related security solutions☆261Updated 5 years ago
- A way to delete a locked file, or current running executable, on disk.☆606Updated 2 months ago
- Collection of malware persistence and hunting information. Be a persistent persistence hunter!☆182Updated 3 weeks ago
- Evasive shellcode loader for bypassing event-based injection detection (PoC)☆809Updated 4 years ago
- Tool to bypass LSA Protection (aka Protected Process Light)☆967Updated 2 years ago
- Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging☆567Updated last year