Alternatives and similar repositories for dearg-thread-ipc-stealth

Users that are interested in dearg-thread-ipc-stealth are comparing it to the libraries listed below

• lawiet47 / STFUEDR

  View on GitHub
  Silence EDRs by removing kernel callbacks
  ☆239Dec 7, 2020Updated 5 years ago
• jfmaes / DeepSleep

  View on GitHub
  all credits go to @mgeeky
  ☆64Oct 14, 2021Updated 4 years ago
• LloydLabs / process-enumeration-stealth

  View on GitHub
  ☆83Aug 26, 2024Updated last year
• Octoberfest7 / Mutants_Sessions_Self-Deletion

  View on GitHub
  Writeup of Payload Techniques in C involving Mutants, Session 1 -> Session 0 migration, and Self-Deletion of payloads.
  ☆129Apr 24, 2022Updated 3 years ago
• mdsecactivebreach / ParallelSyscalls

  View on GitHub
  ☆169Jan 7, 2022Updated 4 years ago
• X-C3LL / wfp-reader

  View on GitHub
  Proof of concept - Covert Channel using Windows Filtering Platform (C#)
  ☆21Aug 29, 2021Updated 4 years ago
• N4kedTurtle / LocalDllParse

  View on GitHub
  ☆55Nov 11, 2021Updated 4 years ago
• outflanknl / FindObjects-BOF

  View on GitHub
  A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific loaded modules or pro…
  ☆275May 3, 2023Updated 2 years ago
• rookuu / BOFs

  View on GitHub
  Collection of beacon object files for use with Cobalt Strike to facilitate 🐚.
  ☆185Feb 11, 2021Updated 5 years ago
• passthehashbrowns / hook-integrity-checks

  View on GitHub
  ☆24May 28, 2021Updated 4 years ago
• jthuraisamy / av-fingerprints

  View on GitHub
  Antivirus Emulator Fingerprints
  ☆30Oct 12, 2018Updated 7 years ago
• LloydLabs / wsb-detect

  View on GitHub
  wsb-detect enables you to detect if you are running in Windows Sandbox ("WSB")
  ☆373Feb 27, 2023Updated 2 years ago
• SolomonSklash / SleepyCrypt

  View on GitHub
  A shellcode function to encrypt a running process image when sleeping.
  ☆340Sep 11, 2021Updated 4 years ago
• Cerbersec / Ares

  View on GitHub
  Project Ares is a Proof of Concept (PoC) loader written in C/C++ based on the Transacted Hollowing technique
  ☆337Jan 16, 2022Updated 4 years ago
• PorLaCola25 / TransactedSharpMiniDump

  View on GitHub
  Implementation of b4rtiks's SharpMiniDump using NTFS transactions to avoid writting the minidump to disk and exfiltrating it via HTTPS us…
  ☆71Nov 14, 2020Updated 5 years ago
• aaaddress1 / sakeInject

  View on GitHub
  Windows PE - TLS (Thread Local Storage) Injector in C/C++
  ☆107Jan 3, 2021Updated 5 years ago
• kyleavery / TitanLdr

  View on GitHub
  Cobalt Strike User Defined Reflective Loader (UDRL). Check branches for different functionality.
  ☆152Jul 20, 2022Updated 3 years ago
• frkngksl / ParallelNimcalls

  View on GitHub
  Nim version of MDSec's Parallel Syscall PoC
  ☆124Jan 14, 2022Updated 4 years ago
• xforcered / Dendrobate

  View on GitHub
  Managed code hooking template.
  ☆108Feb 15, 2021Updated 5 years ago
• leoloobeek / COMRunner

  View on GitHub
  A simple COM server which provides a component to run shellcode
  ☆149May 12, 2020Updated 5 years ago
• nccgroup / DetectWindowsCopyOnWriteForAPI

  View on GitHub
  Enumerate various traits from Windows processes as an aid to threat hunting
  ☆202Jan 13, 2022Updated 4 years ago
• Cracked5pider / KaynLdr

  View on GitHub
  KaynLdr is a Reflective Loader written in C/ASM
  ☆555Dec 3, 2023Updated 2 years ago
• rad9800 / VehApiResolve

  View on GitHub
  ☆118Aug 7, 2022Updated 3 years ago
• kyleavery / ThirdEye

  View on GitHub
  Weaponizing CLRvoyance for Post-Ex .NET Execution
  ☆38Jul 15, 2021Updated 4 years ago
• oXis / GPUSleep

  View on GitHub
  Move CS beacon to GPU memory when sleeping
  ☆251Nov 19, 2021Updated 4 years ago
• janoglezcampos / DeathSleep

  View on GitHub
  A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementin…
  ☆536Aug 1, 2022Updated 3 years ago
• jacob-baines / concealed_position

  View on GitHub
  Bring your own print driver privilege escalation tool
  ☆259Aug 5, 2021Updated 4 years ago
• SolomonSklash / SeasideBishop

  View on GitHub
  A C port of b33f's UrbanBishop
  ☆38Oct 1, 2020Updated 5 years ago
• repnz / apc-research

  View on GitHub
  APC Internals Research Code
  ☆167Jun 28, 2020Updated 5 years ago
• Apr4h / GetInjectedThreads

  View on GitHub
  C# Implementation of Jared Atkinson's Get-InjectedThread.ps1
  ☆54Jul 11, 2021Updated 4 years ago
• Maff1t / WindowsPermsPoC

  View on GitHub
  A simple PoC to demonstrate that is possible to write Non writable memory and execute Non executable memory on Windows
  ☆52Jun 14, 2021Updated 4 years ago
• mgeeky / ThreadStackSpoofer

  View on GitHub
  Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation fr…
  ☆1,193Jun 17, 2022Updated 3 years ago
• thefLink / DeepSleep

  View on GitHub
  A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC
  ☆373May 24, 2022Updated 3 years ago
• optiv / Dent

  View on GitHub
  A framework for creating COM-based bypasses utilizing vulnerabilities in Microsoft's WDAPT sensors.
  ☆297Aug 18, 2023Updated 2 years ago
• SolomonSklash / netntlm

  View on GitHub
  A crappy hook on SpAcceptLsaModeContext that prints incoming auth attempts. WIP
  ☆37Jul 27, 2021Updated 4 years ago
• LloydLabs / delete-self-poc

  View on GitHub
  A way to delete a locked file, or current running executable, on disk.
  ☆616Nov 5, 2025Updated 3 months ago
• crummie5 / FreshyCalls

  View on GitHub
  FreshyCalls tries to make the use of syscalls comfortable and simple, without generating too much boilerplate and in modern C++17!
  ☆357Sep 1, 2022Updated 3 years ago
• rxwx / cs-rdll-ipc-example

  View on GitHub
  Example code for using named pipe output with beacon ReflectiveDLLs
  ☆121Jun 24, 2020Updated 5 years ago
• mez-0 / winrmdll

  View on GitHub
  C++ WinRM API via Reflective DLL
  ☆145Sep 11, 2021Updated 4 years ago