Alternatives and similar repositories for duckcafe

Users that are interested in duckcafe are comparing it to the libraries listed below

• huoji120 / DuckSysEye
  SysEye是一个window上的基于att&ck现代EDR设计思想的威胁响应工具.有效检测常见的未知威胁与已知威胁.防守方的利剑
  ☆64Updated 2 years ago
• Ryze-T / EdrKiller
  ☆91Updated 3 years ago
• dust-life / run_pe
  ☆49Updated 3 years ago
• huoji120 / white_patch_detect
  通杀检测基于白文件patch黑代码的免杀技术的后门
  ☆163Updated 10 months ago
• evilashz / Visual-Studio-BOF-template
  more conveniently Visual-Studio-BOF-template
  ☆65Updated last year
• huoji120 / numen
  简单安排一下 autochk.sys 这个rootkit
  ☆71Updated 2 years ago
• crisprss / PetitPotam
  替代PrintBug用于本地提权的新方式，主要利用MS-EFSR协议中的接口函数 借鉴了Potitpotam中对于EFSR协议的利用,实现了本地提权的一系列方式 Drawing on the use of the EFSR protocol in Potitpotam, …
  ☆149Updated 3 years ago
• Rvn0xsy / j2osWin
  ☆154Updated 11 months ago
• xzxxzzzz000 / impacket-programming-manual
  impacket编程手册
  ☆104Updated last year
• bestspear / ReBeacon_ForClang
  Beacon compiled using clang
  ☆69Updated 2 years ago
• bestspear / SharkOne
  Cobalt Strike 二开项目
  ☆181Updated 2 years ago
• burpheart / CS_mock
  模拟cobalt strike beacon上线包. Simulation cobalt strike beacon connection packet.
  ☆78Updated 2 years ago
• k3lpi3b4nsh33 / BlindEdr
  A Blind EDR Project for Educational Purposes
  ☆36Updated 4 months ago
• Richard-Tang / CrossC2-C2Profile
  CrossC2通信协议API实现
  ☆84Updated 3 years ago
• WBGlIl / ReflectiveDLL_Patch
  ☆37Updated 5 years ago
• NoOne-hub / bypass-BeaconEye
  bypass BeaconEye
  ☆88Updated 3 years ago
• yj94 / Anti-Sandbox
  ☆64Updated 10 months ago
• 1y0n / AVKiller
  一种通过进程注入实现强制关闭部分杀软进程的方法（以360安全卫士和360杀毒为例）
  ☆133Updated last year
• y11en / schtask-bypass
  免杀计划任务进行权限维持，过主流杀软。 A schtask tool bypass anti-virus
  ☆67Updated 2 years ago
• kyxiaxiang / CrackSleeve4.7
  ☆100Updated 2 years ago
• kiwings / DLLHijacker
  ☆80Updated 6 years ago
• WBGlIl / Beacon_re
  ☆89Updated 2 years ago
• crisprss / Extracted_WD_VDM
  Windows Defender VDM lua collections
  ☆47Updated 2 years ago
• huoji120 / APT_Step_Bear_Inject
  复现《EDR的梦魇：Storm-0978使用新型内核注入技术“Step Bear”》
  ☆133Updated 7 months ago
• yanghaoi / CVE-2020-0787
  CVE-2020-0787的简单回显
  ☆32Updated 3 years ago
• Haunted-Banshee / Shellcode-Hastur
  Shellcode Reductio Entropy Tools
  ☆67Updated last year
• Rvn0xsy / GetWindowsCredentials
  通过WindowsAPI获取用户凭证，并保存到文件中
  ☆194Updated 11 months ago
• howmp / donut_ollvm
  Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…
  ☆49Updated last year
• HadesW / power-kill
  power-kill is a project that kill protected processes (such as EDR or AV) by injecting shellcode into high privilege processes
  ☆46Updated 3 years ago
• scareing / UAC_wenpon
  UAC_wenpon
  ☆48Updated 3 years ago