Alternatives and similar repositories for EvilByte-Remote-AMSI-Bypass

Users that are interested in EvilByte-Remote-AMSI-Bypass are comparing it to the libraries listed below

• Faran-17 / Hellshazzard
  Indirect Syscall implementation to bypass userland NTAPIs hooking.
  ☆83Updated last year
• furax124 / Protect_Loader
  A fucking real shellcode loader with a GUI. Work-in-Progress.
  ☆81Updated 6 months ago
• patrickt2017 / VEHNetLoader
  Another version of .NET loader provides capabilities of bypassing ETW and AMSI, utilizing VEH for syscalls and loading .NET assemblies
  ☆49Updated 5 months ago
• zarkones / BloodfangC2
  Modern PIC implant for Windows (64 & 32 bit)
  ☆105Updated 5 months ago
• zero2504 / EDR-GhostLocker
  AppLocker-Based EDR Neutralization
  ☆100Updated last week
• CodeXTF2 / CustomC2ChannelTemplate
  template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader.
  ☆95Updated 2 weeks ago
• 0xTriboulet / rssh-rs
  ☆54Updated 6 months ago
• kleiton0x00 / RtlHijack
  Alternative Read and Write primitives using Rtl* functions the unintended way.
  ☆78Updated 4 months ago
• Maldev-Academy / TrapFlagForSyscalling
  Bypass user-land hooks by syscall tampering via the Trap Flag
  ☆136Updated 4 months ago
• yo-yo-yo-jbo / commandline_spoofing
  Commandline spoofing on Windows
  ☆83Updated last month
• dmcxblue / WSL-Payloads
  A small How-To on creating your own weaponized WSL file
  ☆118Updated 5 months ago
• pygrum / gimmick
  Section-based payload obfuscation technique for x64
  ☆64Updated last year
• OtterHacker / Hooker
  ☆108Updated last year
• HulkOperator / AuthStager
  ☆59Updated last year
• Karkas66 / CelestialSpark
  Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …
  ☆102Updated 9 months ago
• hwbp / LazyHook
  Evade behavioral analysis by executing malicious code within trusted Microsoft call stacks, patchless hooking library IAT/EAT.
  ☆115Updated 2 weeks ago
• warpnet / COM-Fuzzer
  Gain insights into COM/DCOM implementations that may be vulnerable using an automated approach and make it easy to visualize the data. By…
  ☆154Updated last month
• ricardojoserf / NativeTokenImpersonate
  Impersonate Tokens using only NTAPI functions
  ☆83Updated 8 months ago
• dis0rder0x00 / stillepost
  Using Chromium-based browsers as a proxy for C2 traffic.
  ☆130Updated 3 weeks ago
• klezVirus / koppeling-p
  Adaptive DLL hijacking / dynamic export forwarding - EAT preserve
  ☆78Updated last year
• whokilleddb / function-collections
  A collection of PoCs to do common things in unconventional ways
  ☆121Updated 3 months ago
• Cipher7 / havoc-PoolParty
  Windows Thread Pool Injection Havoc Implementation
  ☆33Updated last year
• kr0tt / EarlyExceptionHandling
  Implementing an early exception handler for hooking and threadless process injection without relying on VEH or SEH
  ☆133Updated 3 months ago
• rtecCyberSec / SpeechRuntimeMove
  Lateral Movement as loggedon User via Speech Named Pipe COM & ISpeechNamedPipe + COM Hijacking
  ☆133Updated 5 months ago
• HullaBrian / COMmander
  .NET tool used to enrich RPC telemetry
  ☆101Updated 6 months ago
• NUL0x4C / HookingLsassForCredentials
  Attempting to Hook LSASS APIs to Retrieve Plaintext Credentials
  ☆61Updated 7 months ago
• Whitecat18 / earlycascade-injection
  Early cascade injection PoC based on Outflanks blog post written in Rust
  ☆59Updated 10 months ago
• KingOfTheNOPs / Get-NetNTLM
  Internal Monologue BOF
  ☆78Updated last year
• Print3M / epic
  Extensible Position Independent Code – shellcode (C/C++) development and building toolkit designed for developer experience, predictabili…
  ☆102Updated this week
• olafhartong / ETWLocksmith
  A powerful Windows command-line tool for analyzing and searching ETW (Event Tracing for Windows) provider permissions from the Windows re…
  ☆62Updated 4 months ago