Alternatives and similar repositories for koneko

Users that are interested in koneko are comparing it to the libraries listed below

• MythicAgents / Xenon
  A Mythic agent for Windows written in C
  ☆125Updated 3 weeks ago
• rasta-mouse / process-inject-kit
  Port of Cobalt Strike's Process Inject Kit
  ☆178Updated 6 months ago
• FalconForceTeam / bof-winrm-client
  ☆112Updated 5 months ago
• NtDallas / Ulfberht
  Shellcode loader
  ☆84Updated 6 months ago
• rweijnen / createdump
  Leverage WindowsApp createdump tool to obtain an lsass dump
  ☆149Updated 9 months ago
• CodeXTF2 / WebcamBOF
  Webcam capture capability for Cobalt Strike as a BOF, with in-memory download options
  ☆140Updated 2 months ago
• tdeerenberg / InlineWhispers3
  Tool for working with Indirect System Calls in Cobalt Strike's Beacon Object Files (BOF) using SysWhispers3 for EDR evasion
  ☆83Updated 2 months ago
• Octoberfest7 / enumhandles_BOF
  ☆125Updated 9 months ago
• Octoberfest7 / DropSpawn_BOF
  CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking
  ☆269Updated 2 years ago
• Octoberfest7 / Secure_Stager
  An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution
  ☆188Updated 6 months ago
• NtDallas / Draugr
  BOF with Synthetic Stackframe
  ☆150Updated 3 months ago
• Cipher7 / ApexLdr
  ApexLdr is a DLL Payload Loader written in C
  ☆110Updated 11 months ago
• rbmm / SC_DEMO
  ☆116Updated 3 months ago
• zero2504 / Early-Cryo-Bird-Injections
  Early Bird Cryo Injections – APC-based DLL & Shellcode Injection via Pre-Frozen Job Objects
  ☆98Updated 2 months ago
• boku7 / patchwerk
  BOF that finds all the Nt* system call stubs within NTDLL and overwrites with clean syscall stubs (user land hook evasion)
  ☆184Updated 4 months ago
• som3canadian / Cloudflare-Redirector
  Just another C2 Redirector using CloudFlare. Support multiple C2 and multiple domains. Support for websocket listener.
  ☆167Updated 3 months ago
• CICADA8-Research / TypeLibWalker
  TypeLib persistence technique
  ☆115Updated 8 months ago
• Tw1sm / SQL-BOF
  Library of BOFs to interact with SQL servers
  ☆182Updated 2 months ago
• maxDcb / C2TeamServer
  TeamServer and Client of Exploration Command and Control Framework
  ☆131Updated 3 weeks ago
• cpu0x00 / SharpReflectivePEInjection
  reflectively load and execute PEs locally and remotely bypassing EDR hooks
  ☆155Updated last year
• NtDallas / MemLoader
  Run native PE or .NET executables entirely in-memory. Build the loader as an .exe or .dll—DllMain is Cobalt Strike UDRL-compatible
  ☆90Updated this week
• ewby / Mockingjay_BOF
  Cobalt Strike + Brute Ratel C4 Beacon Object File (BOF) Conversion of the Mockingjay Process Injection Technique
  ☆157Updated last year
• NtDallas / KrakenMask
  Sleep obfuscation
  ☆228Updated 6 months ago
• logangoins / Stifle
  .NET Post-Exploitation Utility for Abusing Explicit Certificate Mappings in ADCS
  ☆147Updated 4 months ago
• NtDallas / Svartalfheim
  Stage 0
  ☆161Updated 6 months ago
• NtDallas / OdinLdr
  Cobaltstrike Reflective Loader with Synthetic Stackframe
  ☆125Updated 4 months ago
• gsmith257-cyber / better-sliver
  Adversary Emulation Framework
  ☆109Updated 11 months ago
• sudonoodle / BOF-entra-authcode-flow
  Beacon Object File (BOF) to obtain Entra tokens via authcode flow.
  ☆93Updated last month
• VoldeSec / PatchlessInlineExecute-Assembly
  Porting of BOF InlineExecute-Assembly to load .NET assembly in process but with patchless AMSI and ETW bypass using hardware breakpoint.
  ☆235Updated 2 years ago
• Offensive-Panda / LsassReflectDumping
  This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone…
  ☆201Updated 8 months ago