Offensive PoC tool for BTR.sys - Microsoft Defender's Boot Time Removal Tool. Supporting material for the BTR Reforged research (Black Hat USA 2026 / DEF CON 34, Las Vegas).
☆148Aug 20, 2026Updated 2 months ago
Alternatives and similar repositories for BTR_CLI
Users that are interested in BTR_CLI are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Proof of concept exploit for CVE-2026-3775/CVE-2026-3780 and CVE-2026-57239 which lets you obtain NT AUTHORITY\SYSTEM rights via the Foxi…☆17Jul 27, 2026Updated 3 months ago
- Beacon Object File (BOF) implementation of the dnscmd.exe functionality used to obtain remote code execution on an ADIDNS server by explo…☆58Jul 8, 2026Updated 3 months ago
- Pass-the-Passkey Family of Attacks☆234Sep 14, 2026Updated last month
- Passive backdoor implant that sniffs for a covert magic-packet trigger and runs tasks written in a custom 23-opcode bytecode command lang…☆57Aug 26, 2026Updated 2 months ago
- Windows Kernel-Mode Shellcode Development Framework (WKMSDF)☆91Aug 1, 2026Updated 3 months ago
- End-to-end encrypted email - Proton Mail • AdSpecial offer: 40% Off Yearly / 80% Off First Month. All Proton services are open source and independently audited for security.
- A concept of using a ROP chain paired with a WRMSR primitive to call kernel functions and map unsigned drivers through BYOVD (AmdTools64.…☆69Sep 21, 2026Updated last month
- PIC shellcode agent based on Stardust framework and Crystal Palace☆94Updated this week
- A stealth-focused kernel-mode virtual HID mouse driver for Windows. Built with KMDF and VHF for precise, hardware-level input simulation …☆49Jul 27, 2026Updated 3 months ago
- Runtime Credential Guard deactivation via \\LSA_ISO_DISABLE_CREDENTIAL_GUARD + LSASS NT hash extraction (Win11 24H2)☆108Oct 27, 2026Updated last week
- A compiled language for Windows position-independent x86-64 shellcode and Beacon Object Files.☆322Jun 28, 2026Updated 4 months ago
- A CET-compatible Windows x64 loader that produces fully backed call stacks through runtime function table manipulation, code cave injecti…☆135Sep 6, 2026Updated 2 months ago
- EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response)☆77Oct 18, 2026Updated 2 weeks ago
- A python proof of concept tool to assist in your payloads classification against EDR/AV's machine learning models☆39Oct 14, 2026Updated 3 weeks ago
- Mythic Peer to Peer (P2P) Communication Protocol via. LLDP☆25Aug 20, 2026Updated 2 months ago
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- BingusLdr is a DLL loader built with Crystal Palace that uses a CET compatible stack spoofing technique.☆117Jul 14, 2026Updated 3 months ago
- ☆56Sep 18, 2026Updated last month
- A community maintained repository of Beacon Object Files (BOFs) for red team operations, research, and education. Our goal is to provide …☆34Aug 8, 2026Updated 2 months ago
- Enhanced Evasion for Threadless Injections☆15May 29, 2026Updated 5 months ago
- Technical documentation, reverse engineering research, and tools for the Windows Endpoint Security Platform (WESP).☆83Sep 18, 2026Updated last month
- Run unsigned kernel payloads in a signed kernel driver via wasm3. No JIT/W^x (HVCI/etc., compliant)☆155Aug 18, 2026Updated 2 months ago
- A poor man's attempt to replicate the shellcode execution technique demo'd by @3lk during STHACK 2026 (https://www.youtube.com/watch?v=al…☆40Oct 14, 2026Updated 3 weeks ago
- Idiomatic Rust Bindings for Windows Hypervisor Platform☆13Apr 11, 2026Updated 6 months ago
- Python scripts that helps in the development of PPKG binaries☆16Jul 31, 2026Updated 3 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Versatile SOCKS5 proxying tool☆16Jun 28, 2026Updated 4 months ago
- Hells Hollow Windows 11 Rootkit technique to Hook the SSDT via Alt Syscalls☆294Jul 13, 2026Updated 3 months ago
- User-mode ETW interception and telemetry manipulation lab for Windows security research.☆43Oct 22, 2026Updated 2 weeks ago
- A collection of BOF-PE's that allow running tailscale from memory☆141Aug 27, 2026Updated 2 months ago
- macOS Container Payload Wrapper☆23Mar 13, 2026Updated 7 months ago
- PoCs for Wellbia XIGNCODE3 anti-cheat xhunter driver family - xhunter1.sys v2023.12.7.78 and xhunter2.sys v2026.6.1.192 (CVE-2026-15430, …☆25Aug 7, 2026Updated 3 months ago
- ☆37May 19, 2026Updated 5 months ago
- example use of defining your own injection technique for explicit injection and or spawn (fork & run)☆19Jan 3, 2026Updated 10 months ago
- DCOM in memory and fileless lateral movement techniques through .Net deserilization☆296Jun 22, 2026Updated 4 months ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advance…☆119Sep 17, 2026Updated last month
- Windows AppResolver LPE PoC with a filtered-admin-to-SYSTEM demonstration☆15Jul 17, 2026Updated 3 months ago
- Hidden Desktop Plugin For Havoc C2,Soon coming for Sliver.☆265Sep 29, 2026Updated last month
- Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, S…☆144Aug 13, 2026Updated 2 months ago
- Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.☆112Oct 27, 2026Updated last week
- Repository for various Beacon Object Files (BOFs)☆185Oct 22, 2026Updated 2 weeks ago
- Proof of Concept for Process Code Injection Without Using WriteProcessMemory☆160Sep 27, 2026Updated last month