Simple ETW unhook PoC. Overwrites NtTraceEvent opcode to disable ETW at Nt-function level.
☆57Feb 29, 2024Updated 2 years ago
Alternatives and similar repositories for etwunhook
Users that are interested in etwunhook are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- DLL Unlinking from InLoadOrderModuleList, InMemoryOrderModuleList, InInitializationOrderModuleList, and LdrpHashTable☆66Apr 4, 2026Updated 7 months ago
- Cobalt Strike notifications via NTFY.☆15Sep 24, 2024Updated 2 years ago
- An Aggressor Script that utilizes NtCreateUserProcess to run binaries☆32Jan 30, 2025Updated last year
- Demonstration of Early Bird APC Injection - MITRE ID T1055.004☆35Oct 31, 2023Updated 3 years ago
- This program is used to perform reflective DLL Injection to a remote process specified by the user.☆60Jul 11, 2023Updated 3 years ago
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Execute shellcode files with rundll32☆230Jan 28, 2024Updated 2 years ago
- DFSCoerce exe revisited version with custom authentication☆43Jan 13, 2024Updated 2 years ago
- A Dynamic MSBuild task to help with minor obfuscation of C# Binaries to evade static signatures on each compilation☆38Jul 30, 2026Updated 3 months ago
- Titan: A generic user defined reflective DLL for Cobalt Strike☆84Nov 20, 2022Updated 3 years ago
- Reflective DLL to privesc from NT Service to SYSTEM using SeImpersonateToken privilege☆229Nov 23, 2023Updated 2 years ago
- Shellcode Loader Utilizing ETW Events☆66Feb 26, 2025Updated last year
- A variation of ProcessOverwriting to execute shellcode on an executable's section☆147Dec 16, 2023Updated 2 years ago
- Walks the CFG bitmap to find previously executable but currently hidden shellcode regions☆141May 17, 2023Updated 3 years ago
- Modified versions of the Cobalt Strike Process Injection Kit☆108Jan 24, 2024Updated 2 years ago
- Deploy open-source AI quickly and easily - Special Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- .NET assembly loader with patchless AMSI and ETW bypass☆393Apr 19, 2023Updated 3 years ago
- Utilizing TLS callbacks to execute a payload without spawning any threads in a remote process☆292Jan 21, 2024Updated 2 years ago
- GhostLoader - AppDomainManager - Injection - 攻壳机动队☆54May 21, 2020Updated 6 years ago
- A stealthy, assembly-based tool for secure function address resolution, offering a robust alternative to GetProcAddress.☆74Mar 6, 2024Updated 2 years ago
- Use hardware breakpoint to dynamically change SSN in run-time☆280Apr 10, 2024Updated 2 years ago
- This project was for my senior capstone at the University of Arizona. I wanted to create a payload that would potentially bypass AV / EDR…☆14Nov 14, 2023Updated 2 years ago
- Modify managed functions from unmanaged code☆53Feb 1, 2024Updated 2 years ago
- Released presentations of my talks + code that used during these talks☆15Sep 5, 2024Updated 2 years ago
- Hijacks code execution via overwriting Control Flow Guard pointers in combase.dll☆155Apr 18, 2025Updated last year
- Deploy open-source AI quickly and easily - Special Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- ☆189Jan 23, 2024Updated 2 years ago
- ☆211Nov 28, 2023Updated 2 years ago
- ☆153Oct 2, 2023Updated 3 years ago
- ☆129Jun 28, 2023Updated 3 years ago
- Shellcode Loader Implementing Indirect Dynamic Syscall , API Hashing, Fileless Shellcode retrieving using Winsock2☆298Jul 15, 2023Updated 3 years ago
- C++ self-Injecting dropper based on various EDR evasion techniques.☆447Feb 11, 2024Updated 2 years ago
- PoC for downloading data by injecting into processes to evade firewalls☆36Nov 29, 2025Updated 11 months ago
- ☆347Jun 24, 2026Updated 4 months ago
- Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.☆326Apr 12, 2024Updated 2 years ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- ☆100Sep 1, 2024Updated 2 years ago
- PhantomsGate: Advanced Shellcode Injection Technique☆28Jul 15, 2024Updated 2 years ago
- ☆11Feb 12, 2023Updated 3 years ago
- A BOF designed to inspect processes memory and addresses☆43Apr 19, 2026Updated 6 months ago
- ☆273Jan 14, 2023Updated 3 years ago
- A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.ht…☆679Dec 23, 2022Updated 3 years ago
- Threadless Module Stomping In Rust with some features (In memory of those murdered in the Nova party massacre)☆266Jun 29, 2024Updated 2 years ago