☆175May 21, 2026Updated 5 months ago
Alternatives and similar repositories for Awesome-EDR-Evasion
Users that are interested in Awesome-EDR-Evasion are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Active Directory forensic framework☆16May 18, 2026Updated 5 months ago
- ☆731Oct 19, 2026Updated last week
- This repository provides a comprehensive Digital Footprint Checklist to help individuals manage their online presence and enhance privacy…☆19Dec 25, 2024Updated last year
- ☆37Sep 6, 2026Updated last month
- Modules designed to be used with the Conquest framework.☆22Sep 3, 2026Updated last month
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- This repository contains detailed adversary simulation APT campaigns targeting various critical sectors. Each simulation includes custom …☆1,155Updated this week
- PolyEngine is an evasive PE packer designed for CTF challenges and low-level Windows security education. It focuses on bypassing EDR and …☆165Aug 6, 2026Updated 2 months ago
- Workshop materials for “Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel” presented at DEF CON 34 and BSidesLV 20…☆398Aug 16, 2026Updated 2 months ago
- A Beacon Object File (BOF) that performs the complete ESC1 attack chain in a single execution: certificate request with arbitrary SAN (+S…☆119Dec 21, 2025Updated 10 months ago
- Lab Work☆83Jun 29, 2026Updated 4 months ago
- This comprehensive and central repository is designed for cybersecurity enthusiasts, researchers, and professionals seeking to stay ahead…☆168Jun 10, 2026Updated 4 months ago
- ☆106Sep 5, 2023Updated 3 years ago
- Live runtime audit for installed Android apps. Runs on the rooted phone, serves a browser dashboard.☆33May 23, 2026Updated 5 months ago
- Amsi Bypass payload that works on Windwos 11☆379Jul 30, 2023Updated 3 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Collection of Notes and CheatSheets used for Red teaming Certs☆504Feb 13, 2023Updated 3 years ago
- This is for Ethical Use only. The default automated binaries created are all burned. I have added the script to the repo to modify certai…☆452Sep 26, 2026Updated last month
- ☆29Sep 9, 2024Updated 2 years ago
- Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass☆147Jan 29, 2026Updated 9 months ago
- A curated list of awesome LOLBins, GTFO projects, and similar 'Living Off the Land' security resources.☆219Jul 11, 2026Updated 3 months ago
- A collection of DPAPI hunting and parsing BOFs☆39Mar 3, 2026Updated 7 months ago
- .NET assembly loader with patching AMSI and ETW bypass☆33Apr 16, 2025Updated last year
- A comprehensive reference repository of C++ code examples for Windows APIs, organized by function name, prefix, and execution context.☆32Feb 23, 2026Updated 8 months ago
- Activation Context Hijacking Evasion Tool☆314Jun 17, 2026Updated 4 months ago
- End-to-end encrypted email - Proton Mail • AdSpecial offer: 40% Off Yearly / 80% Off First Month. All Proton services are open source and independently audited for security.
- BYOVD tool for manipulating Windows Protected Process Light (PPL) protection at the kernel level.☆99May 25, 2026Updated 5 months ago
- Generate an Alphabetical Polymorphic Shellcode☆150Aug 19, 2025Updated last year
- A Windows process injection loader combining PPID spoofing, manual DLL mapping, module stomping, and direct NT syscall☆40Oct 17, 2026Updated last week
- Certighost POC☆337Jul 28, 2026Updated 3 months ago
- A Purple Team lab simulating Active Directory attacks (Kerberoasting, BloodHound, lateral movement) and implementing defensive hardening …☆39Oct 7, 2026Updated 3 weeks ago
- Combining KslDump and GhostKatz to dump LSASS using no-fix KslD.sys memory read to bypass PPL. Extracts MSV1_0 NT hashes and WDigest clea…☆46Mar 27, 2026Updated 7 months ago
- Remote service-staging tool built on Impacket, designed for BOF-style lateral movement workflows that lets you upload custom service load…☆131Dec 7, 2025Updated 10 months ago
- Dynamic shellcode loader with sophisticated evasion capabilities☆344Oct 1, 2025Updated last year
- DynLoader A modular Windows loader focused on EDR evasion Built with indirect syscall (Tartarus Gate / Hell’s Gate), Manual PE parsing …☆82Jul 10, 2026Updated 3 months ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Offensive toolage collection for the Windows environment.☆28Dec 4, 2025Updated 10 months ago
- RingKiller — BYOD PoC for vulnerable driver DCRCVDrv.sys. Abuses IOCTL 0x2205C0 to kill arbitrary processes from ring 0 via ZwTerminatePr…☆26Sep 12, 2026Updated last month
- Modify machine code in binaries with alternative x64 assembly opcodes for AV evasion☆256Sep 11, 2026Updated last month
- Remote DLL Injection with Timer-based Shellcode Execution☆215Jul 18, 2025Updated last year
- Go (formerly PowerShell) collector for adding MSSQL attack paths to BloodHound with OpenGraph☆349Jul 10, 2026Updated 3 months ago
- Collection of programs I made while learning assembly.☆73Jul 26, 2026Updated 3 months ago
- template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader.☆106Jan 10, 2026Updated 9 months ago