Kudaes / Shelter
ROP-based sleep obfuscation to evade memory scanners
☆323Updated 8 months ago
Related projects ⓘ
Alternatives and complementary repositories for Shelter
- Threadless Process Injection through entry point hijacking☆334Updated 2 months ago
- A BOF that runs unmanaged PEs inline☆546Updated 3 weeks ago
- Dynamically invoke arbitrary unmanaged code☆316Updated last month
- Rusty Injection - Shellcode Reflective DLL Injection (sRDI) in Rust (Codename: Venom)☆321Updated 8 months ago
- A beacon object file implementation of PoolParty Process Injection Technique.☆324Updated 11 months ago
- Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.☆244Updated 5 months ago
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆325Updated 5 months ago
- Exploitation of process killer drivers☆188Updated last year
- ☆174Updated 5 months ago
- Call stack spoofing for Rust☆299Updated 2 months ago
- Encrypted shellcode Injection to avoid Kernel triggered memory scans☆344Updated last year
- Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry☆287Updated 3 months ago
- Threadless Module Stomping In Rust with some features (In memory of those murdered in the Nova party massacre)☆225Updated 4 months ago
- TartarusGate, Bypassing EDRs☆533Updated 2 years ago
- Reduce Entropy And Obfuscate Youre Payload With Serialized Linked Lists☆383Updated last year
- ☆245Updated 10 months ago
- EDRSandblast-GodFault☆240Updated last year
- Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…☆209Updated 2 months ago
- BOF implementation of @_EthicalChaos_'s ThreadlessInject project. A novel process injection technique with no thread creation, released a…☆368Updated 10 months ago
- A COFF loader made in Rust☆245Updated last month
- Lateral Movement Using DCOM and DLL Hijacking☆281Updated last year
- C++ self-Injecting dropper based on various EDR evasion techniques.☆341Updated 9 months ago
- Remote Shellcode Injector☆204Updated last year
- Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths☆304Updated 3 months ago
- Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime☆298Updated last year
- ☆235Updated last year
- Native Syscalls Shellcode Injector☆262Updated last year
- Reuse open handles to dynamically dump LSASS.☆234Updated 7 months ago