Slides and POC demo for my talk at Divizion Zero on EDR evasion titled "Evasion Adventures"
☆31Jan 14, 2023Updated 3 years ago
Alternatives and similar repositories for evasion-adventures-files
Users that are interested in evasion-adventures-files are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- This is a simple project made to evade https://github.com/thefLink/Hunt-Sleeping-Beacons by using a busy wait instead of beacon's built i…☆37Jan 15, 2022Updated 4 years ago
- EDR/AV Simulation for Malware Development☆13Oct 21, 2023Updated 2 years ago
- ☆12Nov 12, 2023Updated 2 years ago
- This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for loc…☆55May 8, 2023Updated 3 years ago
- Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle…☆15Jan 7, 2023Updated 3 years ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Bypassing AV, EDR, Application Whitelisting and ASR Rules☆13Apr 18, 2023Updated 3 years ago
- Just a git repo for the sleepmask detection rule i found in https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-…☆16Jun 4, 2025Updated last year
- ☆18May 22, 2024Updated 2 years ago
- Modified versions of the Cobalt Strike Process Injection Kit☆108Jan 24, 2024Updated 2 years ago
- A single byte modification in the kernel memory bypasses and disables all core functions of the AV/EDR security solutions☆18Aug 26, 2025Updated last year
- CSharp reimplementation of Venoma, another C++ Cobalt Strike beacon dropper with custom indirect syscalls execution☆50Apr 22, 2024Updated 2 years ago
- Scripts for public use that we've randomly written, or have updated from other people's work.☆40Jun 25, 2024Updated 2 years ago
- This project is an EDRSandblast fork, adding some features and custom pieces of code.☆16Jan 10, 2024Updated 2 years ago
- MalDev & AV-EDR Evasion for Pentesters☆20Feb 17, 2023Updated 3 years ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- Proxy function calls through the thread pool with ease☆31Feb 27, 2025Updated last year
- Create Cobalt Strike malleable C2 profiles with HTTPS configs☆18May 23, 2020Updated 6 years ago
- Exploits written while preparing for the OSED exam☆28Apr 30, 2024Updated 2 years ago
- Direct syscalls Injection to bypass AV/EDR☆10May 18, 2024Updated 2 years ago
- A powerful Windows UI monitoring and DNS exfiltration tool written in Rust, combining advanced UI event capture capabilities with secure …☆20Mar 6, 2025Updated last year
- Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV☆26Sep 26, 2022Updated 4 years ago
- Research of modifying exported function names at runtime (C/C++, Windows)☆18May 28, 2024Updated 2 years ago
- Firefox webInjector capable of injecting codes into webpages using a mitmproxy.☆43Oct 30, 2022Updated 3 years ago
- Transparently call NTAPI via Halo's Gate with indirect syscalls.☆13Apr 26, 2024Updated 2 years ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- string/file/shellcode encryptor using AES/XOR☆11Oct 15, 2023Updated 2 years ago
- Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low…☆148May 6, 2023Updated 3 years ago
- Exploring different process injection techniques based on malware analysis☆14Dec 28, 2023Updated 2 years ago
- Command line & PPID spoofing☆31Apr 15, 2023Updated 3 years ago
- 在cobaltstrike中使用的bof工具集，收集整理验证好用的bof。☆17Sep 30, 2021Updated 5 years ago
- ☆51Dec 15, 2025Updated 9 months ago
- A Cobalt Strike payload generator and lateral movement aggressor script which places Beacon shellcode into a custom shellcode loader☆44Sep 25, 2024Updated 2 years ago
- frida based script which automates the process of discovering and exploiting DLL Hijacks in target binaries. The discovered binaries can …☆62Apr 18, 2023Updated 3 years ago
- List/Read contents of Zip files (in memory and without extraction) using CobaltStrike's Execute-Assembly☆61May 24, 2022Updated 4 years ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- Techniques that i have used to evade anti-virus during pen tests.☆13May 29, 2018Updated 8 years ago
- A truly Position Independent Code (PIC) NimPlant C2 beacon written in C, without reflective loading.☆67Feb 11, 2025Updated last year
- a simple powershell wrapper to automate checking a user's access around the network☆14Dec 5, 2023Updated 2 years ago
- A firebeam plugin that exploits the CVE-2024-26229 vulnerability to perform elevation of privilege from a unprivileged user☆41Aug 15, 2024Updated 2 years ago
- Process hollowing injection technique for Red Team operations☆18Sep 18, 2023Updated 3 years ago
- A tool that bypasses Windows Defender by manually loading DLLs, parsing EAT directly, and updating IAT with unhooked functions to run M…☆21Jul 14, 2024Updated 2 years ago
- This exploit is utilising AddressOfEntryPoint of process which is RX and using WriteProcessMemory internal magic to change the permission…☆20Oct 31, 2024Updated last year