Detect userland hooks placed by AV/EDR
☆28Sep 4, 2023Updated 3 years ago
Alternatives and similar repositories for DetectHooks
Users that are interested in DetectHooks are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A simple to use single-include Windows API resolver☆22Jul 9, 2024Updated 2 years ago
- Stealthy Loader-cum-dropper/stage-1/stager targeting Windows10☆35Nov 5, 2022Updated 3 years ago
- Evasive Golang Loader☆139Jul 27, 2024Updated 2 years ago
- NimReflectiveLoader is a Nim-based tool for in-memory DLL execution using Reflective DLL Loading.☆32Jan 21, 2024Updated 2 years ago
- Process hollowing injection technique for Red Team operations☆19Sep 18, 2023Updated 3 years ago
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- DFSCoerce exe revisited version with custom authentication☆43Jan 13, 2024Updated 2 years ago
- ☆106Sep 5, 2023Updated 3 years ago
- GetSystem-LCI is a PowerShell script to escalate privileges from Administrator to NT AUTHORITY\SYSTEM by abusing LanguageComponentsInstal…☆35Nov 24, 2024Updated last year
- A Windows token-theft utility that enumerates SYSTEM processes, duplicates their access token, and spawns a new process running as NT AUT…☆66Mar 26, 2026Updated 7 months ago
- Basic interactive Windows kernel offensive toolkit written in C☆139Sep 20, 2025Updated last year
- ☆25Apr 28, 2024Updated 2 years ago
- This are different types of download cradles which should be an inspiration to play and create new download cradles to bypass AV/EPP/EDR …☆258Jul 7, 2022Updated 4 years ago
- generates a shellcode loading powershell script that is xor encrypted☆11Nov 12, 2022Updated 3 years ago
- Simple EDR that injects a DLL into a process to place a hook on specific Windows API☆99Aug 27, 2023Updated 3 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- DebugAmsi is another way to bypass AMSI through the Windows process debugger mechanism.☆103Sep 18, 2023Updated 3 years ago
- Erebus is a payload generator written in Nim.☆19Jun 13, 2023Updated 3 years ago
- A tool to assist DLL hijacking via the Havoc GUI☆14Jan 9, 2024Updated 2 years ago
- ☆26Mar 10, 2022Updated 4 years ago
- Exploits written while preparing for the OSED exam☆29Apr 30, 2024Updated 2 years ago
- Various one-off pentesting projects written in Nim. Updates happen on a whim.☆158May 25, 2026Updated 5 months ago
- PoC for CVE-2023-36802 Microsoft Kernel Streaming Service Proxy☆35Oct 24, 2023Updated 3 years ago
- "D3MPSEC" is a memory dumping tool designed to extract memory dump from Lsass process using various techniques, including direct system c…☆29Sep 18, 2024Updated 2 years ago
- Executing Shellcode with ReadDirectoryChanges’s Hidden Callback☆32Oct 13, 2025Updated last year
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Automatically deploy Nemesis☆20Jun 14, 2024Updated 2 years ago
- Reproducing the SkeletonKey malware.☆12Apr 6, 2024Updated 2 years ago
- Simple Shellcode Runner in Rust Language☆18Dec 8, 2023Updated 2 years ago
- Tool for obtaining information about PPL processes☆16Feb 12, 2024Updated 2 years ago
- SOAPHound is a custom-developed .NET data collector tool which can be used to enumerate Active Directory environments via the Active Dire…☆32May 30, 2024Updated 2 years ago
- Modified version of Impacket to use dynamic NTLMv2 Challenge/Response☆19Dec 26, 2022Updated 3 years ago
- Direct syscalls Injection to bypass AV/EDR☆10May 18, 2024Updated 2 years ago
- PE obfuscator with Evasion in mind☆210Apr 25, 2023Updated 3 years ago
- Tools/scripts I used/developed during the EXP-301 course.☆27May 17, 2022Updated 4 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Info related to the Outflank training: Microsoft Office Offensive Tradecraft☆52May 16, 2024Updated 2 years ago
- XLL Phishing Tradecraft☆438May 24, 2022Updated 4 years ago
- Detour hooking IRQ1 ISR through IDT (Interrupt Descriptor Table)☆21Mar 16, 2026Updated 7 months ago
- ☆19May 22, 2024Updated 2 years ago
- The Kerberoasting / AD password-audit wordlist I use on engagements: priority-merged HashMob large list + The-Viper-One's kerberoast_pws,…☆16Oct 2, 2026Updated 3 weeks ago
- shell code example☆69Dec 12, 2025Updated 10 months ago
- ErebusGate for Nim Bypass AV/EDR☆159Nov 7, 2022Updated 3 years ago