How to bypass AMSI (Antimalware Scan Interface) in PowerShell/C++ by dynamically patching the AmsiScanBuffer function.
☆25Apr 21, 2025Updated 10 months ago
Alternatives and similar repositories for Amsi-Patch-Updated-2025
Users that are interested in Amsi-Patch-Updated-2025 are comparing it to the libraries listed below
Sorting:
- Weaponized VSCode Extensions☆15Updated this week
- PhantomDelay is a precise delay function that uses the Windows high resolution performance counter to pause your program for a specified …☆19May 8, 2025Updated 9 months ago
- 基于多种策略, 对已有 JAR 包中的全限定类名进行变换, 无限生成高度相似的虚假类名☆18Jul 30, 2025Updated 7 months ago
- Toolkit of Projects to attack and evade Event Trace for Windows☆26Aug 28, 2025Updated 6 months ago
- A malicous Golang Package☆15Apr 21, 2025Updated 10 months ago
- NailaoLoader: Hiding Execution Flow via Patching☆22Feb 27, 2025Updated last year
- Let sliver use msf payload!☆25Mar 23, 2025Updated 11 months ago
- A mutliple tactics to execute shellcode in go :}☆23Apr 21, 2025Updated 10 months ago
- remote process injections using pool party techniques☆70Jun 29, 2025Updated 8 months ago
- Cortex EDR Ransomware protection Bypass☆26Feb 8, 2025Updated last year
- Library for reading and writing dex files☆25Updated this week
- Loads NTDLL, parses the PE file, extracts "Zw" functions, retrieves their System Service Numbers (SSNs), and prints each function’s name,…☆15Apr 21, 2025Updated 10 months ago
- Whenever PowerShell is launched, Notepad will also open. You can customize the script for educational purposes, but I emphasize that I do…☆12Apr 21, 2025Updated 10 months ago
- ☆36Feb 12, 2026Updated 2 weeks ago
- Extract entire function source code based on giving line number using Javaparser☆21Jul 15, 2025Updated 7 months ago
- Home of https://redteam.guide☆15Sep 19, 2022Updated 3 years ago
- Rehashing APIs to prevent hash based detection☆14Jan 7, 2025Updated last year
- Bypasses AMSI protection through remote memory patching and parsing technique.☆54May 12, 2025Updated 9 months ago
- Proxy function calls through the thread pool with ease☆31Feb 27, 2025Updated last year
- FrostLock Injection is a freeze/thaw-based code injection technique that uses Windows Job Objects to temporarily freeze (suspend) a targe…☆43Apr 6, 2025Updated 10 months ago
- Eset-Unload is a C++ tool that interacts with a process's loaded modules to identify and unload the ebehmoni.dll module, typically found …☆12Apr 21, 2025Updated 10 months ago
- 通达OA OfficeTask udp 2397 端口远程代码执行RCE检测工具☆21Jun 13, 2025Updated 8 months ago
- linux ebpf backdoor demo☆12Nov 20, 2024Updated last year
- A stager and implant that executes remote Web Assembly☆37Feb 4, 2026Updated 3 weeks ago
- 💎 | RubyRedOps is a repository for advanced Red Team techniques and offensive malware, focused on Ruby☆10Apr 21, 2025Updated 10 months ago
- Perform Thread Hijacking Shellcode Injection without OpenProcess and OpenThread mapping all the free handles in memory☆16Jul 16, 2024Updated last year
- A C#-implemented malware that dynamically modifies its own hash upon each execution to evade detection.☆17Feb 3, 2025Updated last year
- ☆17Feb 14, 2025Updated last year
- Cobalt Strike Beacon Object File (BOF) that obtain SYSTEM privilege with SeImpersonate privilege by passing a malicious IUnknwon object t…☆13Feb 4, 2024Updated 2 years ago
- Payload Dropper with Persistance & Privesc & UAC bypass 🐱👤☆14Apr 8, 2024Updated last year
- A Rust PoC implementation of the Early Bird process hollowing technique, inspired by https://github.com/boku7/HOLLOW.☆31Feb 7, 2025Updated last year
- 查找并使用PspTerminateThreadByPointer函数强制结束进程可以杀360进程 https://www.writebug.com/git/Demon-Gan-123/ring0-force-kill-process.git☆17Dec 21, 2022Updated 3 years ago
- Just another Process Injection using Process Hollowing technique.☆18Sep 18, 2023Updated 2 years ago
- Little java tool to decrypt passwords from Openfire embedded-db☆16Nov 14, 2015Updated 10 years ago
- BypassIT is a framework for covert malware delivery and post-exploitation using AutoIT for red / blue team self assessment.☆45Jul 6, 2025Updated 7 months ago
- Random BOFs for LDAP tradecraft☆74Sep 9, 2025Updated 5 months ago
- The most extensive collection of BOFs (Beacon Object Files) tailored for Red Teams using C++23☆23Jun 19, 2025Updated 8 months ago
- Pattern-based AMSI bypass that patches AMSI.dll in memory by modifying comparison values, conditional jumps, and function prologues to ne…☆27May 13, 2025Updated 9 months ago
- (EDR) Dll Unhooking = kernel32.dll, kernelbase.dll, ntdll.dll, user32.dll, apphelp.dll, msvcrt.dll.☆51May 22, 2025Updated 9 months ago