Evasions encyclopedia gathers methods used by malware to evade detection when run in virtualized environment. Methods are grouped into categories for ease of searching and understanding. Also provided are code samples, signature recommendations and countermeasures within each category for the described techniques.
☆446Mar 31, 2026Updated 7 months ago
Alternatives and similar repositories for Evasions
Users that are interested in Evasions are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- InviZzzible is a tool for assessment of your virtual environments in an easy and reliable way. It contains the most recent and up to date…☆588Mar 31, 2026Updated 7 months ago
- Anti-Debug encyclopedia contains methods used by malware to verify if they are executed under debugging. It includes the description of v…☆70Mar 31, 2026Updated 7 months ago
- A more stealthy variant of "DLL hollowing"☆369Mar 8, 2024Updated 2 years ago
- A PoC~ish of https://elastic.github.io/security-research/malware/2022/01/01.operation-bleeding-bear/article/☆30Feb 26, 2024Updated 2 years ago
- Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.☆7,171Jul 1, 2026Updated 3 months ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- Sandbox evasion modules written in PowerShell, Python, Go, Ruby, C, C#, Perl, and Rust.☆931Jun 1, 2021Updated 5 years ago
- A simple COM server which provides a component to run shellcode☆143May 12, 2020Updated 6 years ago
- AV/EDR evasion via direct system calls.☆2,027Jan 1, 2023Updated 3 years ago
- Open-Source Shellcode & PE Packer☆2,145Feb 3, 2024Updated 2 years ago
- Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging☆609Mar 8, 2024Updated 2 years ago
- Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode☆2,554Nov 15, 2023Updated 2 years ago
- Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation fr…☆1,253Jun 17, 2022Updated 4 years ago
- Enumerate and disable common sources of telemetry used by AV/EDR.☆861Mar 11, 2021Updated 5 years ago
- ☆108May 14, 2018Updated 8 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Adaptive DLL hijacking / dynamic export forwarding☆820Jul 6, 2020Updated 6 years ago
- Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the in…☆1,214Jul 5, 2023Updated 3 years ago
- A shellcode function to encrypt a running process image when sleeping.☆337Sep 11, 2021Updated 5 years ago
- Phantom DLL hollowing PoC☆372May 23, 2022Updated 4 years ago
- LSASS memory dumper using direct system calls and API unhooking.☆1,596Jan 5, 2021Updated 5 years ago
- C/C++ source obfuscator for antivirus bypass☆1,069Mar 10, 2022Updated 4 years ago
- ☆1,856Aug 30, 2024Updated 2 years ago
- SysWhispers on Steroids - AV/EDR evasion via direct system calls.☆1,674Jul 31, 2024Updated 2 years ago
- Anti-virus artifacts. Listing APIs hooked by: Avira, BitDefender, F-Secure, MalwareBytes, Norton, TrendMicro, and WebRoot.☆761Nov 16, 2021Updated 4 years ago
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- ☆2,208Apr 3, 2026Updated 6 months ago
- Tool to create hidden registry keys.☆488Oct 23, 2019Updated 7 years ago
- A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementin…☆542Aug 1, 2022Updated 4 years ago
- MSBuild without MSbuild.exe☆134Dec 21, 2020Updated 5 years ago
- Hellsgate + Halosgate/Tartarosgate. Ensures that all systemcalls go through ntdll.dll☆520Feb 3, 2022Updated 4 years ago
- Evasive shellcode loader for bypassing event-based injection detection (PoC)☆834Aug 23, 2021Updated 5 years ago
- A method of bypassing EDR's active projection DLL's by preventing entry point exection☆1,170Mar 31, 2021Updated 5 years ago
- KaynLdr is a Reflective Loader written in C/ASM☆549Dec 3, 2023Updated 2 years ago
- UnhookMe is an universal Windows API resolver & unhooker addressing problem of invoking unmonitored system calls from within of your Red …☆348Jul 3, 2022Updated 4 years ago
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- Sustainable shellcode evasion☆118May 13, 2026Updated 5 months ago
- Collection of beacon BOF written to learn windows and cobaltstrike☆359Feb 24, 2023Updated 3 years ago
- Managed assembly shellcode generation☆282Mar 19, 2021Updated 5 years ago
- Project Ares is a Proof of Concept (PoC) loader written in C/C++ based on the Transacted Hollowing technique☆336Jan 16, 2022Updated 4 years ago
- ☆831Dec 28, 2019Updated 6 years ago
- Cobalt Strike UDRL for memory scanner evasion.☆1,033Jun 4, 2024Updated 2 years ago
- AV/EDR evasion via direct system calls.☆1,833Sep 3, 2022Updated 4 years ago