Alternatives and similar repositories for bof-vs

Users that are interested in bof-vs are comparing it to the libraries listed below

• tijme / cmstplua-uac-bypass
  Cobalt Strike Beacon Object File for bypassing UAC via the CMSTPLUA COM interface.
  ☆185Updated 2 years ago
• VoldeSec / PatchlessCLRLoader
  .NET assembly loader with patchless AMSI and ETW bypass
  ☆330Updated 2 years ago
• VoldeSec / PatchlessInlineExecute-Assembly
  Porting of BOF InlineExecute-Assembly to load .NET assembly in process but with patchless AMSI and ETW bypass using hardware breakpoint.
  ☆232Updated 2 years ago
• naksyn / DojoLoader
  Generic PE loader for fast prototyping evasion techniques
  ☆231Updated 11 months ago
• ProcessusT / Venoma
  Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution
  ☆180Updated this week
• 0xEr3bus / PoolPartyBof
  A beacon object file implementation of PoolParty Process Injection Technique.
  ☆394Updated last year
• securifybv / Visual-Studio-BOF-template
  A Visual Studio template used to create Cobalt Strike BOFs
  ☆305Updated 3 years ago
• WKL-Sec / LayeredSyscall
  Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …
  ☆257Updated 10 months ago
• vxCrypt0r / AMSI_VEH
  A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…
  ☆161Updated last year
• Octoberfest7 / DropSpawn_BOF
  CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking
  ☆227Updated last year
• NVISOsecurity / CobaltWhispers
  CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files (BOF) for Cobalt Strike to perform process inject…
  ☆232Updated 2 years ago
• MalwareTech / EDRception
  A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.
  ☆187Updated last year
• Cobalt-Strike / bof_template
  A Beacon Object File (BOF) is a compiled C program, written to a convention that allows it to execute within a Beacon process and use int…
  ☆189Updated 2 months ago
• florylsk / ExecIT
  Execute shellcode files with rundll32
  ☆197Updated last year
• gabriellandau / EDRSandblast-GodFault
  EDRSandblast-GodFault
  ☆265Updated last year
• senzee1984 / InflativeLoading
  Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.
  ☆310Updated last year
• Mr-Un1k0d3r / AMSI-ETW-Patch
  Patch AMSI and ETW
  ☆239Updated last year
• 0xHossam / HuffLoader
  Huffman Coding in Shellcode Obfuscation & Dynamic Indirect Syscalls Loader.
  ☆261Updated last month
• BlackSnufkin / BYOVD
  Some POCs for my BYOVD research and find some vulnerable drivers
  ☆217Updated this week
• itm4n / PPLrevenant
  Bypass LSA protection using the BYODLL technique
  ☆161Updated 8 months ago
• ipSlav / DirtyCLR
  An App Domain Manager Injection DLL PoC on steroids
  ☆172Updated last year
• NetSPI / BOF-PE
  An example reference design for a proposed BOF PE
  ☆168Updated last month
• souzomain / Shaco
  Shaco is a linux agent for havoc
  ☆161Updated last year
• ScriptIdiot / BOF-patchit
  An all-in-one Cobalt Strike BOF to patch, check and revert AMSI and ETW for x64 process. Both syscalls and dynamic resolve versions are a…
  ☆135Updated 2 years ago
• Octoberfest7 / Secure_Stager
  An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution
  ☆187Updated 6 months ago
• Cobalt-Strike / sleepmask-vs
  A simple Sleepmask BOF example
  ☆101Updated 8 months ago
• SaadAhla / UnhookingPatch
  Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime
  ☆305Updated last year
• senzee1984 / MutationGate
  Use hardware breakpoint to dynamically change SSN in run-time
  ☆257Updated last year
• Cobalt-Strike / CallStackMasker
  A PoC implementation for dynamically masking call stacks with timers.
  ☆276Updated 2 years ago
• waldo-irc / YouMayPasser
  You shall pass
  ☆259Updated 2 years ago