A repository filled with ideas to break/detect direct syscall techniques
☆25Apr 21, 2022Updated 4 years ago
Alternatives and similar repositories for Breaking-Detecting-Direct-Syscall-Techniques
Users that are interested in Breaking-Detecting-Direct-Syscall-Techniques are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- One gate to all syscalls!☆23Mar 12, 2022Updated 4 years ago
- Halos Gate-based NTAPI Unhooker☆50Apr 21, 2022Updated 4 years ago
- Nice try reading NTDLL from disk, nerd.☆19Apr 18, 2022Updated 4 years ago
- A C port of b33f's UrbanBishop☆38Oct 1, 2020Updated 6 years ago
- Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods☆13Sep 30, 2022Updated 4 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- This driver hooks a device object for ioctl and uses mdls to allocate physical pages and manually injects an entry into a process's page …☆16Feb 14, 2023Updated 3 years ago
- Single stub direct and indirect syscalling with runtime SSN resolving for windows.☆142Sep 12, 2022Updated 4 years ago
- Implant drop-in for EDR testing☆145Nov 15, 2023Updated 2 years ago
- POC of PPID spoofing using NtCreateUserProcess with syscalls to create a suspended process and performing process injection by overwritti…☆41Sep 23, 2021Updated 5 years ago
- ☆16Apr 18, 2023Updated 3 years ago
- A simple program to hook the current process to identify the manual syscall executions on windows☆264Nov 18, 2022Updated 3 years ago
- Reverse TCP Powershell has never been this paranoid. (basically an Opsec-safe reverse powershell)☆30Feb 4, 2022Updated 4 years ago
- UnhookMe is an universal Windows API resolver & unhooker addressing problem of invoking unmonitored system calls from within of your Red …☆348Jul 3, 2022Updated 4 years ago
- Executes shellcode from a remote server and aims to evade in-memory scanners☆31Nov 17, 2019Updated 6 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Bypass Windows defender syscall☆17Jul 17, 2021Updated 5 years ago
- CyberWarFare Labs hands-on workshop on the topic "Detecting Adversarial Tradecrafts/Tools by leveraging ETW"☆51Mar 2, 2022Updated 4 years ago
- Your NTDLL vaccine from modern direct syscall methods.☆35Apr 5, 2022Updated 4 years ago
- Extracting Syscall Stub, Modernized☆65Apr 2, 2022Updated 4 years ago
- Disable PPL via custom driver and dump lsass☆15Mar 13, 2021Updated 5 years ago
- Overwrite a process's recovery callback and execute with WER☆105Apr 17, 2022Updated 4 years ago
- Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes☆107Mar 8, 2023Updated 3 years ago
- Shadow Rebirth - An Aggressive Outbreak Anti-Debugging Technique☆21Dec 3, 2024Updated last year
- Little program written in C# to bypass EDR hooks and dump the content of the lsass process☆58Jun 24, 2021Updated 5 years ago
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Patch AMSI and ETW in remote process via direct syscall☆87Apr 28, 2022Updated 4 years ago
- BOF combination of KillDefender and Backstab☆169Mar 23, 2023Updated 3 years ago
- DLL Unhooking☆12Mar 26, 2021Updated 5 years ago
- My implementation of Halo's Gate technique in C#☆51Apr 20, 2022Updated 4 years ago
- Proof of concept Beacon Object File (BOF) that attempts to detect userland hooks in place by AV/EDR☆101Jul 22, 2021Updated 5 years ago
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆135Jan 2, 2023Updated 3 years ago
- ShellCodeLoader via DInvoke☆59Jul 5, 2021Updated 5 years ago
- ollvm, based on llvm-clang 5.0.2, 6.0.1, 7.0.1, 8.0, 9.0, 9.0.1☆19Apr 4, 2022Updated 4 years ago
- Load shellcode via syscall☆55Jul 28, 2021Updated 5 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Dump Citrix Secure Access auth cookie from the process memory☆75Jun 24, 2022Updated 4 years ago
- Just another casual shellcode native loader☆24Feb 3, 2022Updated 4 years ago
- Load shellcode via HELLGATE, Rewrite hellgate with .net framework for learning purpose.☆17Jan 21, 2022Updated 4 years ago
- Hooking Heavens Gate in a weekend☆12Jan 1, 2022Updated 4 years ago
- Load a fresh new copy of ntdll.dll via file mapping to bypass API inline hook.☆63Sep 6, 2021Updated 5 years ago
- ☆24Jul 29, 2021Updated 5 years ago
- A C# Tool to find left over pentest data for use in your pentest or redteam op. Blue could maybe use to find files to cleanup☆35Sep 14, 2023Updated 3 years ago