Alternatives and similar repositories for EvilByte-Remote-AMSI-Bypass

Users that are interested in EvilByte-Remote-AMSI-Bypass are comparing it to the libraries listed below

• Faran-17 / Hellshazzard
  Indirect Syscall implementation to bypass userland NTAPIs hooking.
  ☆84Updated last year
• kleiton0x00 / RtlHijack
  Alternative Read and Write primitives using Rtl* functions the unintended way.
  ☆70Updated last month
• pygrum / gimmick
  Section-based payload obfuscation technique for x64
  ☆64Updated last year
• zarkones / BloodfangC2
  Modern PIC implant for Windows (64 & 32 bit)
  ☆104Updated 2 months ago
• 0xNinjaCyclone / AsmLdr
  Dynamic shellcode loader with sophisticated evasion capabilities
  ☆80Updated this week
• OtterHacker / Hooker
  ☆108Updated 11 months ago
• ioncodes / SilentLoad
  "Service-less" driver loading
  ☆161Updated 10 months ago
• zero2504 / FrostLock-Injection
  FrostLock Injection is a freeze/thaw-based code injection technique that uses Windows Job Objects to temporarily freeze (suspend) a targe…
  ☆30Updated 5 months ago
• klezVirus / koppeling-p
  Adaptive DLL hijacking / dynamic export forwarding - EAT preserve
  ☆78Updated last year
• pulpocaminante / PPL-0day
  Demoting PPL anti-malware services to less than a guest user
  ☆63Updated 8 months ago
• HulkOperator / AuthStager
  ☆58Updated 11 months ago
• dmcxblue / WSL-Payloads
  A small How-To on creating your own weaponized WSL file
  ☆115Updated 2 months ago
• HullaBrian / COMmander
  .NET tool used to enrich RPC telemetry
  ☆100Updated 3 months ago
• 0xTriboulet / rssh-rs
  ☆53Updated 4 months ago
• Teach2Breach / early_cascade_inj_rs
  early cascade injection PoC based on Outflanks blog post, in rust
  ☆60Updated 10 months ago
• NtDallas / Ulfberht
  Shellcode loader
  ☆94Updated 10 months ago
• Maldev-Academy / TrapFlagForSyscalling
  Bypass user-land hooks by syscall tampering via the Trap Flag
  ☆123Updated last month
• patrickt2017 / VEHNetLoader
  Another version of .NET loader provides capabilities of bypassing ETW and AMSI, utilizing VEH for syscalls and loading .NET assemblies
  ☆47Updated 2 months ago
• NUL0x4C / HookingLsassForCredentials
  Attempting to Hook LSASS APIs to Retrieve Plaintext Credentials
  ☆58Updated 4 months ago
• rbmm / SC
  shell code example
  ☆62Updated last week
• kr0tt / EarlyExceptionHandling
  Implementing an early exception handler for hooking and threadless process injection without relying on VEH or SEH
  ☆122Updated last month
• akamai / Mirage
  Mirage is a PoC memory evasion technique that relies on a vulnerable VBS enclave to hide shellcode within VTL1.
  ☆100Updated 7 months ago
• passthehashbrowns / VectoredExceptionHandling
  ☆93Updated last year
• nbaertsch / PoolProxy
  Proxy function calls through the thread pool with ease
  ☆29Updated 7 months ago
• 0xRedpoll / SignalKeyBOF
  BOF to decrypt Signal Desktop chat logs
  ☆72Updated 7 months ago
• andreisss / Remote-DLL-Injection-with-Timer-based-Shellcode-Execution
  Remote DLL Injection with Timer-based Shellcode Execution
  ☆143Updated 2 months ago
• ricardojoserf / NativeTokenImpersonate
  Impersonate Tokens using only NTAPI functions
  ☆80Updated 6 months ago
• tijme / relocatable
  Boilerplate to develop raw and truly Position Independent Code (PIC).
  ☆104Updated 8 months ago
• whokilleddb / sinister-vsix
  Blog/Journal on how to backdoor VSCode extensions
  ☆74Updated 2 months ago
• Teach2Breach / pool_party_rs
  remote process injections using pool party techniques
  ☆66Updated 3 months ago