MalwareTech / EDRception
A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.
☆179Updated last year
Alternatives and similar repositories for EDRception:
Users that are interested in EDRception are comparing it to the libraries listed below
- .NET assembly loader with patchless AMSI and ETW bypass☆306Updated last year
- A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…☆153Updated 7 months ago
- Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…☆215Updated 4 months ago
- Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.☆259Updated 7 months ago
- Shaco is a linux agent for havoc☆153Updated last year
- Extracting NetNTLM without touching lsass.exe☆232Updated last year
- Remote Shellcode Injector☆207Updated last year
- Use hardware breakpoint to dynamically change SSN in run-time☆241Updated 9 months ago
- EDRSandblast-GodFault☆243Updated last year
- Bypass LSA protection using the BYODLL technique☆153Updated 3 months ago
- Generic PE loader for fast prototyping evasion techniques☆189Updated 6 months ago
- DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely☆318Updated last month
- Evasive Golang Loader☆132Updated 5 months ago
- ☆249Updated 11 months ago
- Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …☆233Updated 5 months ago
- Port of Cobalt Strike's Process Inject Kit☆160Updated last month
- This repository implements Threadless Injection in C☆156Updated last year
- 「💀」Proof of concept on BYOVD attack☆154Updated last month
- Stealthily inject shellcode into an executable☆132Updated 3 months ago
- reflectively load and execute PEs locally and remotely bypassing EDR hooks☆149Updated last year
- Sleep obfuscation☆199Updated last month
- An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution☆157Updated last month
- Shellcode Loader Implementing Indirect Dynamic Syscall , API Hashing, Fileless Shellcode retrieving using Winsock2☆288Updated last year
- Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.☆270Updated 9 months ago
- Execute shellcode files with rundll32☆190Updated 11 months ago
- Bypass Credential Guard by patching WDigest.dll using only NTAPI functions☆211Updated last month
- Lateral Movement Using DCOM and DLL Hijacking☆282Updated last year
- Porting of BOF InlineExecute-Assembly to load .NET assembly in process but with patchless AMSI and ETW bypass using hardware breakpoint.☆197Updated last year