Helixo32 / SimpleEDR
Simple EDR that injects a DLL into a process to place a hook on specific Windows API
☆88Updated last year
Related projects ⓘ
Alternatives and complementary repositories for SimpleEDR
- Two in one, patch lifetime powershell console, no more etw and amsi!☆80Updated 4 months ago
- Example code samples from our ScriptBlock Smuggling Blog post☆83Updated 5 months ago
- IronSharpPack is a repo of popular C# projects that have been embedded into IronPython scripts that execute an AMSI bypass and then refle…☆104Updated 6 months ago
- Slide decks and/or materials from conference presentations☆54Updated 2 years ago
- Your syscall factory☆121Updated 2 months ago
- Living Off the Foreign Land setup scripts☆63Updated 3 weeks ago
- ☆83Updated 2 years ago
- A collection of various and sundry code snippets that leverage .NET dynamic tradecraft☆135Updated 6 months ago
- Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctype…☆108Updated last year
- ☆109Updated 3 years ago
- Lateral Movement via the .NET Profiler☆76Updated 5 months ago
- This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.☆72Updated 2 months ago
- A web assembly (WASM) phishing lure generator based on pre-built templates and written in Rust with some GenAI assistance. W.A.L.K. aims …☆59Updated 2 months ago
- Info related to the Outflank training: Microsoft Office Offensive Tradecraft☆51Updated 6 months ago
- Embedder is a collection of sources in different languages to embed Python interpreter with minimal dependencies☆114Updated 5 months ago
- Bypass AMSI By Dividing files into multiple smaller files☆45Updated last year
- ☆68Updated last year
- Various one-off pentesting projects written in Nim. Updates happen on a whim.☆145Updated last week
- Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged☆86Updated 2 years ago
- Utilities for obfuscating shellcode☆45Updated 4 months ago
- Resources linked to my presentation at OffensiveX in Athens in June 2024 on the topic "Breach the Gat, Advanced Initial Access in 2024"☆123Updated 3 months ago
- Grab NetNTLMv2 hashes using ETW with administrative rights on Windows 8.1 / Windows Server 2016 and later☆89Updated last year
- Small project to facilitate creation of .lnk payloads☆62Updated 2 years ago
- Interactive Shell and Command Execution over Named-Pipes (SMB) for Fileless lateral movement☆88Updated last month
- A tool for carrying out brute force attacks against Office 365, with built in IP rotation use AWS gateways.☆74Updated 5 months ago
- POC for frustrating/defeating Malware Analysts☆150Updated 2 years ago
- Find DLLs with RWX section☆75Updated last year
- Python module for running BOFs☆64Updated last year
- Lifetime AMSI bypass.☆36Updated 4 months ago
- Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post☆86Updated 2 years ago