DGRonpa / Process_Injection
☆27Updated 2 years ago
Alternatives and similar repositories for Process_Injection:
Users that are interested in Process_Injection are comparing it to the libraries listed below
- A proof of concept I developed to improve Gargoyle back in 2018 to achieve true memory obfuscation from position independent code☆43Updated 4 months ago
- ☆110Updated 2 years ago
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆122Updated 2 years ago
- ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption☆81Updated last year
- ☆46Updated 2 years ago
- ☆132Updated 2 years ago
- RDLL for Cobalt Strike beacon to silence sysmon process☆87Updated 2 years ago
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆51Updated last year
- yet another sleep encryption thing. also used the default github repo name for this one.☆69Updated last year
- Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.☆39Updated last year
- Piece of code to detect and remove hooks in IAT☆62Updated 2 years ago
- abusing Process Hacker driver to terminate other processes (BYOVD)☆81Updated last year
- Titan: A crappy Reflective Loader written in C and assembly for Cobalt Strike. Redirects DNS Beacon over DoH☆44Updated 3 years ago
- Files for http://blog.deniable.org/posts/windows-callbacks/☆69Updated 2 years ago
- Monitors ETW for security relevant syscalls maintaining the set called by each unique process☆70Updated last year
- A simple dumper as FreshyCalls' PoC. That's what's trendy, isn't it? ¯\_(ツ)_/¯☆39Updated 4 years ago
- Halos Gate-based NTAPI Unhooker☆49Updated 2 years ago
- ☆37Updated 3 years ago
- Overwrite a process's recovery callback and execute with WER☆102Updated 2 years ago
- Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections☆111Updated last year
- Patch AMSI and ETW in remote process via direct syscall☆80Updated 2 years ago
- I have documented all of the AMSI patches that I learned till now☆69Updated last year
- Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged☆86Updated 2 years ago
- ☆79Updated 5 months ago
- ☆73Updated last year
- Do some DLL SideLoading magic☆77Updated last year
- Single stub direct and indirect syscalling with runtime SSN resolving for windows.☆132Updated 2 years ago
- Sleep Obfuscation☆43Updated 2 years ago
- Small PoC of using a Microsoft signed executable as a lolbin.☆133Updated last year
- ☆36Updated last year