JLospinoso / cpp-implant

Related projects: ⓘ

• shogunlab / building-c2-implants-in-cpp
  The source code files that accompany the short book "Building C2 Implants in C++: A Primer" by Steven Patterson (@shogun_lab).
  ☆218Updated 2 months ago
• reevesrs24 / EvasiveProcessHollowing
  Evasive Process Hollowing Techniques
  ☆132Updated 4 years ago
• Accenture / CLRvoyance
  Managed assembly shellcode generation
  ☆261Updated 3 years ago
• jhackz / RTO-Implant
  Red Team Operator: Malware Development Essentials Course
  ☆92Updated 4 years ago
• leoloobeek / COMProxy
  PoC for proxying COM objects when hijacking
  ☆197Updated 5 years ago
• CCob / SylantStrike
  Simple EDR implementation to demonstrate bypass
  ☆152Updated 4 years ago
• kymb0 / Malware_learns
  ☆124Updated last year
• ajpc500 / NimlineWhispers
  A very proof-of-concept port of InlineWhispers for using syscalls in Nim projects.
  ☆161Updated 3 years ago
• dalvarezperez / CreateFile_based_rootkit
  ☆131Updated last year
• Cracked5pider / conti_locker
  Conti Locker source code
  ☆178Updated 2 years ago
• hasherezade / masm_shc
  A helper utility for creating shellcodes. Cleans MASM file generated by MSVC, gives refactoring hints.
  ☆157Updated 2 months ago
• y11en / FOLIAGE
  Experiment on reproducing Obfuscate & Sleep
  ☆136Updated 3 years ago
• boku7 / HOLLOW
  EarlyBird process hollowing technique (BOF) - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and e…
  ☆263Updated last year
• bats3c / EvtMute
  Apply a filter to the events being reported by windows event logging
  ☆259Updated 3 years ago
• boku7 / winx64-InjectAllProcessesMeterpreter-Shellcode
  64bit Windows 10 shellcode that injects all processes with Meterpreter reverse shells.
  ☆127Updated last year
• rad9800 / WTSRM
  WTSRM
  ☆198Updated 2 years ago
• SecIdiot / FOLIAGE
  ☆99Updated this week
• asaurusrex / Probatorum-EDR-Userland-Hook-Checker
  Project to check which Nt/Zw functions your local EDR is hooking
  ☆179Updated 3 years ago
• uf0o / rootkit-arsenal-guacamole
  An attempt to restore and adapt to modern Win10 version the 'Rootkit Arsenal' original code samples
  ☆65Updated 2 years ago
• SolomonSklash / SleepyCrypt
  A shellcode function to encrypt a running process image when sleeping.
  ☆329Updated 3 years ago
• med0x2e / NoAmci
  Using DInvoke to patch AMSI.dll in order to bypass AMSI detections triggered when loading .NET tradecraft via Assembly.Load().
  ☆213Updated 4 years ago
• boku7 / Nobelium-PdfDLRunAesShellcode
  A recreation of the "Nobelium" malware based on Microsofts Malware analysis - Part 1: PDF2Pwn
  ☆100Updated last year
• paranoidninja / PIC-Get-Privileges
  Building and Executing Position Independent Shellcode from Object Files in Memory
  ☆154Updated 3 years ago
• manyfacedllama / amsi-tracer
  Leverage AMSI (Antimalware Scan Interface) technology to aid your analysis. This tool saves all buffers (scripts, .NET assemblies, etc) …
  ☆86Updated 3 years ago
• netbiosX / AMSI-Provider
  A fake AMSI Provider which can be used for persistence.
  ☆134Updated 3 years ago
• Bw3ll / ShellWasp
  ShellWasp is a tool to help build shellcode that utilizes Windows syscalls, while overcoming the portability problem associated with Wind…
  ☆156Updated last year
• NVISOsecurity / brown-bags
  ☆111Updated last year
• am0nsec / vx
  Virus Exchange (VX) - Collection of malware or assembly code used for "offensive" purposed.
  ☆176Updated 2 years ago
• c0de90e7 / GhostWriting
  GhostWriting Injection Technique.
  ☆162Updated 6 years ago