Alternatives and similar repositories for Detecting-Indirect-Syscalls

Users that are interested in Detecting-Indirect-Syscalls are comparing it to the libraries listed below

• HullaBrian / COMmander
  .NET tool used to enrich RPC telemetry
  ☆100Updated 5 months ago
• klezVirus / koppeling-p
  Adaptive DLL hijacking / dynamic export forwarding - EAT preserve
  ☆78Updated last year
• OtterHacker / Hooker
  ☆108Updated last year
• HulkOperator / AuthStager
  ☆59Updated last year
• Bl4ckM1rror / PEAs
  ☆60Updated last year
• OffenseTeacher / Steganim
  ☆47Updated 2 years ago
• nothingspecialforu / EvtPsst
  EvtPsst
  ☆55Updated 2 years ago
• frkngksl / UnlinkDLL
  DLL Unlinking from InLoadOrderModuleList, InMemoryOrderModuleList, InInitializationOrderModuleList, and LdrpHashTable
  ☆58Updated last year
• zarkones / BloodfangC2
  Modern PIC implant for Windows (64 & 32 bit)
  ☆105Updated 4 months ago
• pygrum / gimmick
  Section-based payload obfuscation technique for x64
  ☆64Updated last year
• hlldz / misc
  miscellaneous codes
  ☆36Updated 2 years ago
• patrickt2017 / VEHNetLoader
  Another version of .NET loader provides capabilities of bypassing ETW and AMSI, utilizing VEH for syscalls and loading .NET assemblies
  ☆49Updated 4 months ago
• yo-yo-yo-jbo / commandline_spoofing
  Commandline spoofing on Windows
  ☆49Updated this week
• Offensive-Panda / DV_NEW
  This is the combination of multiple evasion techniques to evade defenses. (Dirty Vanity)
  ☆51Updated last year
• MaorSabag / Paruns-Fart
  Just another ntdll unhooking using Parun's Fart technique
  ☆75Updated 2 years ago
• oldboy21 / JayFinder
  Find DLLs with RWX section
  ☆80Updated 2 years ago
• cpu0x00 / EternelSuspention
  a simple poc showcasing the ability of an admin to suspend EDR's protected processes , making it useless
  ☆39Updated last year
• Faran-17 / Hellshazzard
  Indirect Syscall implementation to bypass userland NTAPIs hooking.
  ☆84Updated last year
• offalltn / gitC2
  POC of GITHUB simple C2 in rust
  ☆52Updated 4 months ago
• andreisss / Living-off-the-COM-Type-Coercion-Abuse
  This technique leverages PowerShell's .NET interop layer and COM automation to achieve stealthy command execution by abusing implicit typ…
  ☆51Updated 6 months ago
• whokilleddb / sinister-vsix
  Blog/Journal on how to backdoor VSCode extensions
  ☆75Updated 4 months ago
• fin3ss3g0d / NativeThreadpool
  Work, timer, and wait callback example using solely Native Windows APIs.
  ☆88Updated last year
• silentwarble / Hannibal
  Mythic C2 Agent written in x64 PIC C
  ☆83Updated 10 months ago
• kas-sec / version.dll-sideloading
  sideloading PoC using onedrive.exe & version.dll
  ☆79Updated last month
• nickvourd / Rocabella
  Sniffing files generator
  ☆59Updated 9 months ago
• TwoSevenOneT / EDR-Redir
  EDR-Redir : a tool used to redirect the EDR's folder to another location.
  ☆183Updated 3 weeks ago
• inb1ts / birdnet-poc
  Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.
  ☆41Updated 2 years ago
• warpnet / COM-Fuzzer
  Gain insights into COM/DCOM implementations that may be vulnerable using an automated approach and make it easy to visualize the data. By…
  ☆149Updated last week
• wolfcod / lsassdump
  lsassdump via RtlCreateProcessReflection and NanoDump
  ☆83Updated last year
• pulpocaminante / PPL-0day
  Demoting PPL anti-malware services to less than a guest user
  ☆64Updated 10 months ago