D1rkMtr / ExplorerPersist

Related projects: ⓘ

• D1rkMtr / RecyclePersist
  ☆96Updated this week
• D1rkMtr / PatchThatAMSI
  ☆60Updated this week
• hrtywhy / BOF-CobaltStrike
  Useful Cobalt Strike Beacon Object Files (BOFs) used during red teaming and penetration testing engagements.
  ☆72Updated 2 years ago
• SaadAhla / D1rkSleep
  Improved version of EKKO by @5pider that Encrypts only Image Sections
  ☆110Updated last year
• embee-research / Randomise-api-hashes-cobalt-strike
  Bypass Detection By Randomising ROR13 API Hashes
  ☆131Updated 2 years ago
• D1rkMtr / FileLessRemoteShellcode
  ☆138Updated this week
• klezVirus / NimlineWhispers3
  A tool for converting SysWhispers3 syscalls for use with Nim projects
  ☆137Updated 2 years ago
• reveng007 / AMSI-patches-learned-till-now
  I have documented all of the AMSI patches that I learned till now
  ☆66Updated last year
• CodeXTF2 / HavocNotion
  A simple ExternalC2 POC for Havoc C2. Communicates over Notion using a custom python agent, handler and extc2 channel. Not operationally …
  ☆78Updated last year
• securityandstuff / DynamicFinder
  ☆65Updated this week
• Wh04m1001 / DiagTrackEoP
  ☆87Updated 2 years ago
• werdhaihai / SharpAltShellCodeExec
  Alternative Shellcode Execution Via Callbacks in C# with P/Invoke
  ☆74Updated last year
• D1rkMtr / PatchAMSI
  ☆68Updated this week
• xalicex / LOLDrivers_finder
  ☆70Updated last year
• Cracked5pider / LsaParser
  ☆99Updated this week
• NUL0x4C / ApiHashing
  ☆100Updated this week
• ZeroMemoryEx / Overlord
  abusing Process Hacker driver to terminate other processes (BYOVD)
  ☆81Updated last year
• ewby / Mockingjay_BOF
  Cobalt Strike + Brute Ratel C4 Beacon Object File (BOF) Conversion of the Mockingjay Process Injection Technique
  ☆147Updated 10 months ago
• eversinc33 / Godmode
  Tool for playing with Windows Access Token manipulation.
  ☆50Updated last year
• gavz / ExplorerPersist
  Explorer Persistence technique : Hijacking cscapi.dll order loading path and writing our malicious dll into C:\Windows\cscapi.dll , when …
  ☆65Updated last year
• EspressoCake / DLL-Exports-Extraction-BOF
  DLL Exports Extraction BOF with optional NTFS transactions.
  ☆76Updated 2 years ago
• MaorSabag / SideLoadingDLL
  Do some DLL SideLoading magic
  ☆72Updated last year
• Maldev-Academy / DRMBinViaOrdinalImports
  Create Anti-Copy DRM Malware
  ☆36Updated last month
• passthehashbrowns / BOFMask
  ☆105Updated last year
• CodeXTF2 / cobaltstrike-headless
  Aggressorscript that turns the headless aggressor client into a (mostly) functional cobalt strike client.
  ☆145Updated 2 years ago
• ScriptIdiot / sleepmask_PatchlessHook
  Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW
  ☆76Updated last year
• trustedsec / PPLFaultDumpBOF
  ☆132Updated last year
• Mav3rick33 / ZenLdr
  Basic implementation of Cobalt Strikes - User Defined Reflective Loader feature
  ☆93Updated last year
• mrd0x / pe2shc-to-cdb
  Convert shellcode generated using pe_2_shellcode to cdb format.
  ☆95Updated 2 years ago
• kyleavery / TitanLdr
  Cobalt Strike User Defined Reflective Loader (UDRL). Check branches for different functionality.
  ☆134Updated 2 years ago