CheckPointSW / EvasionsLinks
Evasions encyclopedia gathers methods used by malware to evade detection when run in virtualized environment. Methods are grouped into categories for ease of searching and understanding. Also provided are code samples, signature recommendations and countermeasures within each category for the described techniques.
☆410Updated 11 months ago
Alternatives and similar repositories for Evasions
Users that are interested in Evasions are comparing it to the libraries listed below
Sorting:
- Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs☆755Updated last year
- Anti-virus artifacts. Listing APIs hooked by: Avira, BitDefender, F-Secure, MalwareBytes, Norton, TrendMicro, and WebRoot.☆740Updated 3 years ago
- A Windows kernel-mode rootkit that abuses legitimate communication channels to control a machine.☆705Updated 4 years ago
- Enumerate and disable common sources of telemetry used by AV/EDR.☆801Updated 4 years ago
- Quickly debug shellcode extracted during malware analysis☆604Updated 2 years ago
- My implementation of enSilo's Process Doppelganging (PE injection technique)☆620Updated 2 years ago
- Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the in…☆1,144Updated last year
- Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted fi…☆664Updated last year
- Expriments☆463Updated 8 months ago
- Dynamic unpacker based on PE-sieve☆736Updated 3 weeks ago
- ☆814Updated 5 years ago
- Research on Anti-malware and other related security solutions☆259Updated 4 years ago
- Live hunting of code injection techniques☆382Updated 5 years ago
- Extract Windows Defender database from vdm files and unpack it☆443Updated last week
- Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)☆581Updated last year
- PeaceMaker Threat Detection is a Windows kernel-based application that detects advanced techniques used by malware.☆421Updated 5 years ago
- AV/EDR evasion via direct system calls.☆1,891Updated 2 years ago
- ☆473Updated 2 years ago
- Small and convenient C2 tool for Windows targets. [ Русский -- значит нахуй! ]☆611Updated 3 years ago
- Yet another variant of Process Hollowing☆400Updated 4 months ago
- ☆299Updated 4 years ago
- A modular C2 framework☆476Updated 2 months ago
- Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)☆813Updated 3 years ago
- Original C Implementation of the Hell's Gate VX Technique☆1,061Updated 3 years ago
- SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also conta…☆394Updated last month
- A way to delete a locked file, or current running executable, on disk.☆548Updated 10 months ago
- Virus Exchange (VX) - Collection of malware or assembly code used for "offensive" purposed.☆181Updated 3 years ago
- A memory scanning evasion technique☆872Updated 8 years ago
- Evade sysmon and windows event logging☆624Updated 5 years ago
- ☆489Updated 7 years ago