Alternatives and similar repositories for AMSI-Bypasses:

Users that are interested in AMSI-Bypasses are comparing it to the libraries listed below

• a7t0fwa7 / DllDragon
  A simple to use single-include Windows API resolver
  ☆19Updated 6 months ago
• nettitude / SyscallsExtractor
  ☆23Updated 2 years ago
• ZephrFish / SandboxSpy
  Code for profiling sandboxes - Initially an idea to profile sandboxes, the code is written to take enviromental variables and send them b…
  ☆20Updated 9 months ago
• mdsecactivebreach / SharpAltiris
  ☆24Updated 2 years ago
• ceramicskate0 / SharpLeftOvers
  A C# Tool to find left over pentest data for use in your pentest or redteam op. Blue could maybe use to find files to cleanup
  ☆35Updated last year
• attl4s / freeMetsrvLoader
  freeBokuLoader fork which targets and frees Metsrv's initial reflective DLL package
  ☆34Updated last year
• joeminicucci / RedIra
  A cloud automation system for Red Teams based on Terraform and Ansible
  ☆24Updated 3 years ago
• Flangvik / collector
  Utility to analyse, ingest and push out credentials from common data sources during an internal penetration test.
  ☆19Updated 2 years ago
• codewhitesec / daphne
  Proof-of-Concept to evade auditd by tampering via ptrace
  ☆16Updated last year
• samisecure / LsassDumpReflectiveDll
  Dump Lsass Memory Using a Reflective Dll
  ☆14Updated 2 years ago
• OtterHacker / LabS4U2Self
  ☆29Updated 2 years ago
• redskal / malrdp-deploy
  Automated (kinda) deployment of MalRDP infrastructure with Terraform & Ansible
  ☆11Updated last year
• patrickhener / invictus
  OSED Practice binary
  ☆24Updated last year
• kartikdurg / Enum-LSASS
  LSASS enumeration like pypykatz written in C-Lang
  ☆20Updated 3 years ago
• ZeroPointSecurity / Domain-Enumeration-Tool
  Perform Windows domain enumeration via LDAP
  ☆36Updated 2 years ago
• xenoscr / SharpMailBOF
  A BOF.NET program to split a file into smaller chunks and email it via a specified SMTP relay.
  ☆14Updated 3 years ago
• xforcered / DayBird
  Extension functionality for the NightHawk operator client
  ☆26Updated last year
• xenoscr / compressedCredBandit
  A variation CredBandit that uses compression to reduce the size of the data that must be trasnmitted.
  ☆18Updated 3 years ago
• malcomvetter / TLAD
  The Totally Legit Authentication Dialog
  ☆12Updated last year
• ChoiSG / GwisinMsi
  PoC MSI payload based on ASEC/AhnLab's blog post
  ☆23Updated 2 years ago
• oldboy21 / CGPL
  Yet, Another Packer/Loader
  ☆25Updated last year
• MrDomainAdmin / LyinEagle
  Python C2 with JScript Implant
  ☆14Updated last year
• lapolis / palinka_c2
  Just another useless C2 occupying space in some HDD somewhere.
  ☆20Updated last year
• Allevon412 / BreadBear
  A PoC~ish of https://elastic.github.io/security-research/malware/2022/01/01.operation-bleeding-bear/article/
  ☆30Updated 11 months ago
• slemire / bof-adopt
  BOF implementation of Adopt. Spawns a process from a process. Can sometimes be used to run a session > 0 process from session 0.
  ☆14Updated 2 years ago
• bugch3ck / AspectInstallAssistantRCE
  POC for unauthenticated RCE in Aspect Unified Installation Assistant by Aspect Software found in 2021.
  ☆12Updated last year
• shlyuz / teamserver
  ☆12Updated 2 years ago
• tid4l / SharpCGHunter
  Receive the status of Windows Defender Credential Guard on network hosts.
  ☆27Updated 3 years ago
• EspressoCake / Needle_Sift_BOF
  Strstr with user-supplied needle and filename as a BOF.
  ☆31Updated 3 years ago
• Muhammad-Ali007 / OutlookNTLM_CVE-2023-23397
  ☆21Updated last year