Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services, the registry and running drivers for the presence of known defensive products such as AV's, EDR's and logging tools.
☆281Oct 9, 2023Updated 3 years ago
Alternatives and similar repositories for Invoke-EDRChecker
Users that are interested in Invoke-EDRChecker are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories,…☆759Feb 24, 2026Updated 8 months ago
- Python3 tool to perform password spraying using RDP☆676Aug 17, 2023Updated 3 years ago
- Exploitation paths allowing you to (mis)use the Windows Privileges to elevate your rights within the OS.☆2,527Feb 24, 2023Updated 3 years ago
- Scripts to make password spraying attacks against Lync/S4B, OWA & O365 a lot quicker, less painful and more efficient☆1,578Oct 17, 2022Updated 4 years ago
- Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensi…☆4,755Jan 10, 2025Updated last year
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- The Hunt for Malicious Strings☆1,426May 13, 2025Updated last year
- "Golden" certificates☆714Aug 17, 2024Updated 2 years ago
- Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, …☆960Nov 11, 2024Updated last year
- Identifies the bytes that Microsoft Defender flags on.☆2,643Dec 31, 2025Updated 10 months ago
- Windows Local Privilege Escalation from Service Account to System☆975Feb 23, 2020Updated 6 years ago
- Auto-generate an HTaccess for payload delivery -- automatically pulls ips/nets/etc from known sandbox companies/sources that have been se…☆170Aug 10, 2020Updated 6 years ago
- MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, i…☆3,291Sep 21, 2026Updated last month
- Privilege Escalation Enumeration Script for Windows☆4,003Oct 28, 2026Updated last week
- Enumerate and disable common sources of telemetry used by AV/EDR.☆865Mar 11, 2021Updated 5 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Recon-AD, an AD recon tool based on ADSI and reflective DLL’s☆332Oct 20, 2019Updated 7 years ago
- PoC tool to coerce Windows hosts authenticate to other machines via the MS-RPRN RPC interface. This is possible via other protocols as w…☆1,147May 29, 2024Updated 2 years ago
- Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR AppDomainManager, Stomping Loader/.NET assembly PE DOS head…☆598Jul 26, 2021Updated 5 years ago
- Trying to tame the three-headed dog.☆5,209May 21, 2026Updated 5 months ago
- A proxy aware C2 framework used to aid red teamers with post-exploitation and lateral movement.☆2,137Nov 20, 2025Updated 11 months ago
- A method of bypassing EDR's active projection DLL's by preventing entry point exection☆1,173Mar 31, 2021Updated 5 years ago
- GhostBuild is a collection of simple MSBuild launchers for various GhostPack/.NET projects☆253Sep 26, 2020Updated 6 years ago
- socks4 reverse proxy for penetration testing☆674Jul 12, 2018Updated 8 years ago
- Fileless lateral movement tool that relies on ChangeServiceConfigA to run command☆1,675Jul 10, 2023Updated 3 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GP…☆1,364Dec 15, 2020Updated 5 years ago
- Covenant is a collaborative .NET C2 framework for red teamers.☆4,745Jul 18, 2024Updated 2 years ago
- I used this to see if an EDR is running in Safe Mode☆33Feb 13, 2021Updated 5 years ago
- C# Script used for Red Team☆714Nov 16, 2021Updated 4 years ago
- A PowerShell armoury for security guys and girls☆466Jan 23, 2024Updated 2 years ago
- Phantom DLL hollowing PoC☆373May 23, 2022Updated 4 years ago
- Windows Exploit Suggester - Next Generation☆4,976Updated this week
- A simple COM server which provides a component to run shellcode☆143May 12, 2020Updated 6 years ago
- StandIn is a small .NET35/45 AD post-exploitation toolkit☆255Dec 2, 2021Updated 4 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Fork of SafetyKatz that dynamically fetches the latest pre-compiled release of Mimikatz directly from gentilkiwi GitHub repo, runtime pat…☆887Mar 29, 2021Updated 5 years ago
- Shellcode runner in GO that incorporates shellcode encryption, remote process injection, block dlls, and spoofed parent process☆226Jul 30, 2020Updated 6 years ago
- Excel Macro Document Reader/Writer for Red Teamers & Analysts☆523May 19, 2026Updated 5 months ago
- Get file less command execution for lateral movement.☆643Jun 3, 2022Updated 4 years ago
- Process Injection☆763Oct 24, 2021Updated 5 years ago
- StandIn is a small .NET35/45 AD post-exploitation toolkit☆879Dec 2, 2023Updated 2 years ago
- SpoolSample -> Responder w/NetNTLM Downgrade -> NetNTLMv1 -> NTLM -> Kerberos Silver Ticket☆985Jul 26, 2021Updated 5 years ago