RistBS / ContextMenuHijack
Execute a payload at each right click on a file/folder in the explorer menu for persistence
☆170Updated last year
Alternatives and similar repositories for ContextMenuHijack:
Users that are interested in ContextMenuHijack are comparing it to the libraries listed below
- A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…☆169Updated last year
- Exploitation of echo_driver.sys☆169Updated last year
- Improved version of EKKO by @5pider that Encrypts only Image Sections☆117Updated last year
- Use hardware breakpoints to spoof the call stack for both syscalls and API calls☆184Updated 7 months ago
- Huffman Coding in Shellcode Obfuscation & Dynamic Indirect Syscalls Loader.☆88Updated 10 months ago
- A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge …☆172Updated last year
- Cobalt Strike User Defined Reflective Loader (UDRL). Check branches for different functionality.☆135Updated 2 years ago
- A PoC implementation for dynamically masking call stacks with timers.☆260Updated last year
- reflectively load and execute PEs locally and remotely bypassing EDR hooks☆149Updated last year
- ☆120Updated last year
- Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution☆168Updated 10 months ago
- ☆133Updated 2 years ago
- The code is a pingback to the Dark Vortex blog: https://0xdarkvortex.dev/hiding-memory-allocations-from-mdatp-etwti-stack-tracing/☆172Updated last year
- Block any Process to open HANDLE to your process , only SYTEM is allowed to open handle to your process ,with that you can avoid remote m…☆167Updated last year
- Load a dynamic library from memory by modifying the native Windows loader☆207Updated last week
- Patch AMSI and ETW in remote process via direct syscall☆80Updated 2 years ago
- Implementation of Indirect Syscall technique to pop a calc.exe☆95Updated 11 months ago
- Cobalt Strike Beacon Object File for bypassing UAC via the CMSTPLUA COM interface.☆150Updated 2 years ago
- A basic emulation of an "RPC Backdoor"☆238Updated 2 years ago
- BOF combination of KillDefender and Backstab☆162Updated last year
- ☆149Updated last year
- .NET assembly loader with patchless AMSI and ETW bypass☆308Updated last year
- The code is a pingback to the Dark Vortex blog:☆169Updated last year
- A nice process dumping tool☆78Updated 2 years ago
- Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …☆233Updated 5 months ago
- CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking☆220Updated last year