PorLaCola25 / ProcessDoppelganging
Process doppelganging POC using direct system calls, PPID spoofing and dropbox as an external delivery channel for the payload.
☆14Updated 3 years ago
Related projects ⓘ
Alternatives and complementary repositories for ProcessDoppelganging
- Convert native dll to shellcode, and support exported function☆22Updated 3 years ago
- C++ implementation of DOUBLEPULSAR usermode shellcode. Yet another Reflective DLL loader.☆29Updated 3 years ago
- Demo to show how write ALPC Client & Server using native Ntdll.dll syscalls.☆20Updated 2 years ago
- Process Hollowing Packer☆25Updated 7 years ago
- ☆22Updated last year
- ☆11Updated 2 years ago
- A crappy hook on SpAcceptLsaModeContext that prints incoming auth attempts. WIP☆33Updated 3 years ago
- ☆15Updated 3 years ago
- ☆26Updated 2 years ago
- Protected Process (Light) Dump: Uses Zemana AntiMalware Engine To Open a Privileged Handle to a PP/PPL Process And Inject MiniDumpWriteDu…☆22Updated 4 years ago
- A PoC tool for exploiting leaked process and thread handles☆30Updated 8 months ago
- A kernel mode Windows rootkit in development.☆49Updated 2 years ago
- Process Injection: APC Injection☆27Updated 3 years ago
- Rookit and anti rookit on Windows platform☆10Updated 6 months ago
- Code injection via ZwCreateSection, ZwUnmapViewOfSection. C++ example☆17Updated 2 years ago
- This is a simple project made to evade https://github.com/thefLink/Hunt-Sleeping-Beacons by using a busy wait instead of beacon's built i…☆30Updated 2 years ago
- ☆27Updated 3 months ago
- POC of PPID spoofing using NtCreateUserProcess with syscalls to create a suspended process and performing process injection by overwritti…☆38Updated 3 years ago
- ☆15Updated 2 years ago
- Reflective DLL that hooks the creation of the UAC prompt popped by explorer.exe for privilege escalation.☆20Updated 3 years ago
- Open-source EDR kernel-component for system monitoring and DLL injection☆30Updated 3 years ago
- A repository filled with ideas to break/detect direct syscall techniques☆26Updated 2 years ago
- Tiny driver patch to allow kernel callbacks to work on Win10 21h1☆31Updated 2 years ago
- Windows RPC example calling stubs generated from MS-LSAT and MS-LSAD☆24Updated 10 months ago
- ☆48Updated last year