Alternatives and similar repositories for espio

Users that are interested in espio are comparing it to the libraries listed below

• hid3rx / PEPacker
  ☆95Updated last year
• ProcessusT / Venoma
  Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution
  ☆180Updated last week
• Cobalt-Strike / bof-vs
  A Beacon Object File (BOF) template for Visual Studio
  ☆197Updated 2 months ago
• aplyc1a / PEMemoryLoader
  Load static-compiled PE from remote server.
  ☆62Updated 3 years ago
• EvilBytecode / EDR-XDR-AV-Killer
  Reproducing Spyboy technique, which involves terminating all EDR/XDR/AVs processes by abusing the zam64.sys driver
  ☆274Updated last month
• naksyn / DojoLoader
  Generic PE loader for fast prototyping evasion techniques
  ☆231Updated 11 months ago
• tijme / cmstplua-uac-bypass
  Cobalt Strike Beacon Object File for bypassing UAC via the CMSTPLUA COM interface.
  ☆185Updated 2 years ago
• reveng007 / ReflectiveNtdll
  A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…
  ☆169Updated 2 years ago
• VoldeSec / PatchlessCLRLoader
  .NET assembly loader with patchless AMSI and ETW bypass
  ☆331Updated 2 years ago
• oldboy21 / RflDllOb
  Reflective DLL Injection Made Bella
  ☆227Updated 4 months ago
• WKL-Sec / LayeredSyscall
  Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …
  ☆257Updated 10 months ago
• RistBS / ContextMenuHijack
  Execute a payload at each right click on a file/folder in the explorer menu for persistence
  ☆174Updated 2 years ago
• MalwareTech / EDRception
  A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.
  ☆187Updated last year
• RalfHacker / CVE-2024-26229-exploit
  Windows LPE
  ☆125Updated 11 months ago
• Maldev-Academy / GhostlyHollowingViaTamperedSyscalls
  Implementing the ghostly hollowing PE injection technique using tampered syscalls.
  ☆156Updated 2 months ago
• VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls
  The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls
  ☆192Updated last year
• 0x00Check / Amaterasu
  Amaterasu terminates, or inhibits, protected processes such as application control and AV/EDR solutions by leveraging the Sysinternals Pr…
  ☆72Updated last year
• CICADA8-Research / IHxExec
  Process injection alternative
  ☆330Updated 9 months ago
• cpu0x00 / SharpReflectivePEInjection
  reflectively load and execute PEs locally and remotely bypassing EDR hooks
  ☆153Updated last year
• M01N-Team / HeaderLessPE
  ☆241Updated last year
• SaadAhla / D1rkSleep
  Improved version of EKKO by @5pider that Encrypts only Image Sections
  ☆119Updated 2 years ago
• Chainski / PandaLoader
  A WIP shellcode loader tool which bypasses AV/EDR, coded in C++, and equipped with a minimal builder.
  ☆53Updated last month
• senzee1984 / InflativeLoading
  Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.
  ☆314Updated last year
• vxCrypt0r / AMSI_VEH
  A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…
  ☆161Updated last year
• florylsk / NtRemoteLoad
  Remote Shellcode Injector
  ☆217Updated last year
• senzee1984 / MutationGate
  Use hardware breakpoint to dynamically change SSN in run-time
  ☆260Updated last year
• dlima04 / thread-pool-injection
  PoC for thread pool based process injection in Windows.
  ☆116Updated 2 months ago
• kleiton0x00 / RemoteShellcodeExec
  Execute shellcode from a remote-hosted bin file using Winhttp.
  ☆234Updated last year
• 0xEr3bus / PoolPartyBof
  A beacon object file implementation of PoolParty Process Injection Technique.
  ☆394Updated last year
• YOLOP0wn / EchoDrv
  Exploitation of echo_driver.sys
  ☆170Updated last year