Alternatives and similar repositories for MFTool

Users that are interested in MFTool are comparing it to the libraries listed below

• dis0rder0x00 / obex
  Obex – Blocking unwanted DLLs in user mode
  ☆280Updated 4 months ago
• MythicAgents / Hannibal
  A Mythic Agent written in PIC C.
  ☆206Updated last year
• rad9800 / byor
  ☆163Updated 7 months ago
• zero2504 / EDR-GhostLocker
  AppLocker-Based EDR Neutralization
  ☆289Updated last month
• 0xsch1zo / NullGate
  Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.
  ☆165Updated 6 months ago
• Cracked5pider / earlycascade-injection
  early cascade injection PoC based on Outflanks blog post
  ☆236Updated last year
• safedv / RustSoliloquy
  A Rust implementation of Internal-Monologue — retrieving NetNTLM hashes without touching LSASS, leveraging SSPI for NTLM negotiation and …
  ☆191Updated 9 months ago
• Macmod / ldapx
  Flexible LDAP proxy that can be used to inspect & transform all LDAP packets generated by other tools on the fly.
  ☆188Updated last month
• 0xNinjaCyclone / EarlyCascade
  A PoC for Early Cascade process injection technique.
  ☆205Updated last year
• RedSiege / Jigsaw
  Hide shellcode by shuffling bytes into a random array and reconstruct at runtime
  ☆202Updated 10 months ago
• 0xsp-SRD / MDE_Enum
  comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reducti…
  ☆212Updated last year
• oldkingcone / BYOSI
  Evade EDR's the simple way, by not touching any of the API's they hook.
  ☆168Updated last year
• Maldev-Academy / TrapFlagForSyscalling
  Bypass user-land hooks by syscall tampering via the Trap Flag
  ☆138Updated 5 months ago
• Maldev-Academy / MaldevAcademyLdr.2
  RunPE implementation with multiple evasive techniques (2)
  ☆268Updated 4 months ago
• andreisss / Ghosting-AMSI
  Ghosting-AMSI
  ☆220Updated 9 months ago
• Octoberfest7 / Secure_Stager
  An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution
  ☆194Updated last year
• jakobfriedl / conquest
  Conquest is a feature-rich and malleable command & control/post-exploitation framework developed in Nim.
  ☆259Updated this week
• deepinstinct / DCOMUploadExec
  DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely
  ☆381Updated last year
• ricardojoserf / NativeBypassCredGuard
  Bypass Credential Guard by patching WDigest.dll using only NTAPI functions
  ☆265Updated 10 months ago
• yo-yo-yo-jbo / dumping_lsass
  The different ways to dump lsass
  ☆236Updated 5 months ago
• 3lp4tr0n / SessionHop
  Windows Session Hijacking via COM
  ☆335Updated last month
• ZERODETECTION / MSC_Dropper
  ☆244Updated last year
• 0xthirteen / Carseat
  Python implementation of GhostPack's Seatbelt situational awareness tool
  ☆270Updated last year
• synacktiv / GroupPolicyBackdoor
  Group Policy Objects manipulation and exploitation framework
  ☆288Updated 2 months ago
• NVISOsecurity / codasm
  Payload encoding utility to effectively lower payload entropy.
  ☆123Updated 9 months ago
• rtecCyberSec / Packer_Development
  Slides & Code snippets for a workshop held @ x33fcon 2024
  ☆282Updated last year
• Kudaes / Eclipse
  Activation Context Hijack
  ☆169Updated 6 months ago
• ColeHouston / Sunder
  Windows rootkit designed to work with BYOVD exploits
  ☆214Updated last year
• NtDallas / Svartalfheim
  Stage 0
  ☆169Updated last year
• synacktiv / Invoke-RunAsWithCert
  A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine.
  ☆169Updated last year