SaadAhla / AMSI_patch
Patching AmsiOpenSession by forcing an error branching
☆143Updated last year
Alternatives and similar repositories for AMSI_patch:
Users that are interested in AMSI_patch are comparing it to the libraries listed below
- Patch AMSI and ETW☆237Updated 10 months ago
- Porting of BOF InlineExecute-Assembly to load .NET assembly in process but with patchless AMSI and ETW bypass using hardware breakpoint.☆214Updated last year
- A PoC that combines AutodialDLL lateral movement technique and SSP to scrape NTLM hashes from LSASS process.☆296Updated 2 years ago
- ☆181Updated last year
- Extracting NetNTLM without touching lsass.exe☆235Updated last year
- reflectively load and execute PEs locally and remotely bypassing EDR hooks☆151Updated last year
- CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking☆226Updated last year
- Havoc C2 profile generator☆73Updated 4 months ago
- C# POC to extract NetNTLMv1/v2 hashes from ETW provider☆252Updated last year
- Source generator to add D/Invoke and indirect syscall methods to a C# project.☆175Updated last year
- A BOF to automate common persistence tasks for red teamers☆273Updated 2 years ago
- ☆154Updated last year
- Lateral Movement Using DCOM and DLL Hijacking☆287Updated last year
- ☆120Updated last year
- ☆116Updated last year
- Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods☆105Updated last year
- BOF and Python3 implementation of technique to unbind 445/tcp on Windows via SCM interactions☆287Updated 4 months ago
- Cobalt Strike BOF that identifies Attack Surface Reduction (ASR) rules, actions, and exclusion locations☆152Updated last year
- ☆193Updated 11 months ago
- ☆144Updated 7 months ago
- An App Domain Manager Injection DLL PoC on steroids☆167Updated last year
- My implementation of the GIUDA project in C++☆167Updated last year
- different ntdll unhooking techniques : unhooking ntdll from disk, from KnownDlls, from suspended process, from remote server (fileless)☆186Updated last year
- WTSImpersonator utilizes WTSQueryUserToken to steal user tokens by abusing the RPC Named Pipe "\\pipe\LSM_API_service"☆118Updated 8 months ago
- ☆161Updated 7 months ago
- Attempt at Obfuscated version of SharpCollection☆205Updated last month
- ☆223Updated 10 months ago
- Shaco is a linux agent for havoc☆156Updated last year
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆111Updated last year
- Execute shellcode files with rundll32☆191Updated last year