EvilBytecode / Ebyte-AMSI-ProxyInjectorLinks
A lightweight tool that injects a custom assembly proxy into a target process to silently bypass AMSI scanning by redirecting AmsiScanBuffer calls. It suspends the target’s threads, patches the function to always return AMSI_RESULT_CLEAN without altering original bytes directly, ensuring stealthy AMSI bypass.
☆40Updated last month
Alternatives and similar repositories for Ebyte-AMSI-ProxyInjector
Users that are interested in Ebyte-AMSI-ProxyInjector are comparing it to the libraries listed below
Sorting:
- ☆55Updated 7 months ago
- Bypasses AMSI protection through remote memory patching and parsing technique.☆44Updated last month
- Attempting to Hook LSASS APIs to Retrieve Plaintext Credentials☆52Updated last month
- 「⚠️」Performing a BYOVD on the truesight.sys driver☆36Updated 6 months ago
- POC of GITHUB simple C2 in rust☆53Updated 4 months ago
- lsassdump via RtlCreateProcessReflection and NanoDump☆82Updated 8 months ago
- Tool to bypass LSA Protection (aka Protected Process Light)☆54Updated 5 months ago
- "D3MPSEC" is a memory dumping tool designed to extract memory dump from Lsass process using various techniques, including direct system c…☆24Updated 9 months ago
- Construct the payload at runtime using an array of offsets☆63Updated last year
- converts sRDI compatible dlls to shellcode☆29Updated 5 months ago
- Section-based payload obfuscation technique for x64☆60Updated 10 months ago
- Indirect Syscall implementation to bypass userland NTAPIs hooking.☆73Updated 10 months ago
- Go Shellcode Loader to be Integrated in Exploration C2☆27Updated 4 months ago
- ☆52Updated 6 months ago
- Work, timer, and wait callback example using solely Native Windows APIs.☆89Updated last year
- ☆49Updated 3 weeks ago
- Create Anti-Copy DRM Malware☆57Updated 10 months ago
- ☆36Updated 6 months ago
- Cortex EDR Ransomware protection Bypass☆24Updated 4 months ago
- ☆57Updated 7 months ago
- Attempting to Hook LSASS APIs to Retrieve Plaintext Credentials☆47Updated last month
- A BOF to retrieve decryption keys for WhatsApp Desktop and a utility script to decrypt the databases.☆76Updated 3 months ago
- A remote process injection using process snapshotting based on https://gitlab.com/ORCA000/snaploader , in rust. It creates a sacrificial …☆49Updated 4 months ago
- Unhook Ntdll.dll, Go & C++.☆24Updated 2 months ago
- .NET tool used to enrich RPC telemetry☆62Updated last week
- A modification to fortra's CVE-2023-28252 exploit, compiled to exe☆54Updated last year
- A BOF that suspends non-GUI threads for a target process or resumes them resulting in stealthy process silencing.☆52Updated 2 months ago
- ☆22Updated 3 months ago
- Abusing SSRF to deliver an authenticated command injection payload☆30Updated 3 months ago
- NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg☆46Updated last year