RATandC2 / FilelessNtdllReflection
Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle to ntdll, and trigger exported API from the export table
☆15Updated 2 years ago
Alternatives and similar repositories for FilelessNtdllReflection:
Users that are interested in FilelessNtdllReflection are comparing it to the libraries listed below
- ☆42Updated last year
- ☆13Updated 2 years ago
- API Hammering with C++20☆45Updated 2 years ago
- Remove API hooks from a Beacon process.☆13Updated 3 years ago
- yet another sleep encryption thing. also used the default github repo name for this one.☆70Updated last year
- Your NTDLL vaccine from modern direct syscall methods.☆35Updated 2 years ago
- Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.☆42Updated last year
- ☆36Updated 2 years ago
- A method to execute shellcode using RegisterWaitForInputIdle API.☆52Updated last year
- Bypass UAC elevation on Windows 8 (build 9600) & above.☆54Updated 2 years ago
- Get your data from the resource section manually, with no need for windows apis☆58Updated 4 months ago
- Artemis - C++ Hell's Gate Syscall Implementation☆32Updated last year
- A crappy hook on SpAcceptLsaModeContext that prints incoming auth attempts. WIP☆33Updated 3 years ago
- ☆19Updated 2 years ago
- EmbedExeLnk by x86matthew modified by d4rkiZ☆34Updated last year
- ☆19Updated 3 weeks ago
- ☆29Updated 2 years ago
- A Cobalt Strike payload generator and lateral movement aggressor script which places Beacon shellcode into a custom shellcode loader☆19Updated 5 months ago
- Titan: A crappy Reflective Loader written in C and assembly for Cobalt Strike. Redirects DNS Beacon over DoH☆46Updated 3 years ago
- Threadless injection via TLS callbacks☆16Updated 3 months ago
- Set the process mitigation policy for loading only Microsoft Modules , and block any userland 3rd party modules☆41Updated last year
- A care package of useful bofs for red team engagments☆54Updated 3 months ago
- A reimplementation of Cobalt Strike's Beacon Object File (BOF) Loader☆43Updated last year
- This script is used to bypass DLL Hooking using a fresh mapped copy of ntdll file, patch the ETW and trigger a shellcode with process hol…☆67Updated last year
- Slides and POC demo for my talk at Divizion Zero on EDR evasion titled "Evasion Adventures"☆26Updated 2 years ago
- Simple PoC to locate hooked functions by EDR in ntdll.dll☆36Updated last year
- Bunch of BOF files☆30Updated 2 months ago
- Windows x64 Process Injection via Ghostwriting with Dynamic Configuration☆28Updated 3 years ago
- Beacon Object Files (not Buffer Overflows)☆53Updated 2 years ago