Alternatives and similar repositories for cpp-implant:

Users that are interested in cpp-implant are comparing it to the libraries listed below

• shogunlab / building-c2-implants-in-cpp
  The source code files that accompany the short book "Building C2 Implants in C++: A Primer" by Steven Patterson (@shogun_lab).
  ☆225Updated last month
• reevesrs24 / EvasiveProcessHollowing
  Evasive Process Hollowing Techniques
  ☆135Updated 4 years ago
• jhackz / RTO-Implant
  Red Team Operator: Malware Development Essentials Course
  ☆96Updated 4 years ago
• dalvarezperez / CreateFile_based_rootkit
  ☆131Updated last year
• y11en / FOLIAGE
  Experiment on reproducing Obfuscate & Sleep
  ☆141Updated 3 years ago
• leoloobeek / COMProxy
  PoC for proxying COM objects when hijacking
  ☆203Updated 5 years ago
• Accenture / CLRvoyance
  Managed assembly shellcode generation
  ☆264Updated 3 years ago
• hasherezade / masm_shc
  A helper utility for creating shellcodes. Cleans MASM file generated by MSVC, gives refactoring hints.
  ☆160Updated last month
• NVISOsecurity / brown-bags
  ☆111Updated last year
• CCob / SylantStrike
  Simple EDR implementation to demonstrate bypass
  ☆163Updated 4 years ago
• Cracked5pider / conti_locker
  Conti Locker source code
  ☆188Updated 2 years ago
• Signal-Labs / NtdllUnpatcher
  Example code for EDR bypassing
  ☆149Updated 5 years ago
• WithSecureLabs / ModuleStomping
  https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/
  ☆118Updated 5 years ago
• Mr-Un1k0d3r / DLLsForHackers
  Dll that can be used for side loading and other attack vector.
  ☆201Updated 4 years ago
• boku7 / Nobelium-PdfDLRunAesShellcode
  A recreation of the "Nobelium" malware based on Microsofts Malware analysis - Part 1: PDF2Pwn
  ☆100Updated last year
• boku7 / winx64-InjectAllProcessesMeterpreter-Shellcode
  64bit Windows 10 shellcode that injects all processes with Meterpreter reverse shells.
  ☆128Updated last year
• asaurusrex / Probatorum-EDR-Userland-Hook-Checker
  Project to check which Nt/Zw functions your local EDR is hooking
  ☆180Updated 3 years ago
• med0x2e / NoAmci
  Using DInvoke to patch AMSI.dll in order to bypass AMSI detections triggered when loading .NET tradecraft via Assembly.Load().
  ☆213Updated 4 years ago
• bats3c / EvtMute
  Apply a filter to the events being reported by windows event logging
  ☆260Updated 3 years ago
• rad9800 / WTSRM
  WTSRM
  ☆206Updated 2 years ago
• forrest-orr / phantom-dll-hollower-poc
  Phantom DLL hollowing PoC
  ☆353Updated 2 years ago
• oXis / GPUSleep
  Move CS beacon to GPU memory when sleeping
  ☆242Updated 3 years ago
• netbiosX / AMSI-Provider
  A fake AMSI Provider which can be used for persistence.
  ☆141Updated 3 years ago
• amitwaisel / Malproxy
  Proxy system calls over an RPC channel
  ☆97Updated 2 years ago
• outflanknl / InlineWhispers
  Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF)
  ☆309Updated 3 years ago
• jfmaes / AmsiHooker
  Hookers are cooler than patches.
  ☆168Updated 3 years ago
• paranoidninja / PIC-Get-Privileges
  Building and Executing Position Independent Shellcode from Object Files in Memory
  ☆154Updated 4 years ago
• xforcered / CredBandit
  Proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that b…
  ☆235Updated 3 years ago
• 0xpat / COFFInjector
  PoC MSVC COFF Object file loader/injector.
  ☆169Updated 3 years ago
• waldo-irc / MalMemDetect
  Detect strange memory regions and DLLs
  ☆174Updated 3 years ago