Set the process mitigation policy for loading only Microsoft Modules , and block any userland 3rd party modules
☆41May 6, 2023Updated 3 years ago
Alternatives and similar repositories for BlockNonMSModules
Users that are interested in BlockNonMSModules are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Block any Process to open HANDLE to your process , only SYTEM is allowed to open handle to your process ,with that you can avoid remote m…☆172Apr 27, 2023Updated 3 years ago
- yet another sleep encryption thing. also used the default github repo name for this one.☆67May 11, 2023Updated 3 years ago
- Encypting the Heap while sleeping by hooking and modifying Sleep with our own sleep that encrypts the heap☆247Aug 2, 2023Updated 3 years ago
- Create a new thread that will suspend every thread and encrypt its stack, then going to sleep , then decrypt the stacks and resume thread…☆167Aug 2, 2023Updated 3 years ago
- Shellcode Loader Implementing Indirect Dynamic Syscall , API Hashing, Fileless Shellcode retrieving using Winsock2☆13Jul 15, 2023Updated 3 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle…☆306Aug 2, 2023Updated 3 years ago
- Improved version of EKKO by @5pider that Encrypts only Image Sections☆124Feb 13, 2023Updated 3 years ago
- AIDA64DRIVER Elevation of Privilege Vulnerability☆17Oct 25, 2024Updated 2 years ago
- Utilizing hardware breakpoints to evade monitoring by Endpoint Detection and Response platforms☆138Dec 20, 2022Updated 3 years ago
- Patching AmsiOpenSession by forcing an error branching☆153Aug 2, 2023Updated 3 years ago
- This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret …☆266Apr 29, 2023Updated 3 years ago
- Simple Kernel Mode Driver for Swapping Process Token☆130Sep 19, 2026Updated last month
- This script is used to unload PsSetCreateProcessNotifyRoutineEx, PsSetCreateProcessNotifyRoutine, PsSetLoadImageNotifyRoutine and PsSetCr…☆66Feb 11, 2024Updated 2 years ago
- A RunAs clone with the ability to specify the password as an argument.☆110Jul 2, 2023Updated 3 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW☆87Mar 19, 2023Updated 3 years ago
- PhantomsGate: Advanced Shellcode Injection Technique☆28Jul 15, 2024Updated 2 years ago
- The program uses the Windows API functions to traverse through directories and locate DLL files with RWX section☆112Jul 15, 2023Updated 3 years ago
- Execute a payload at each right click on a file/folder in the explorer menu for persistence☆172Mar 15, 2023Updated 3 years ago
- Dropping a powershell script at %HOMEPATH%\Documents\WindowsPowershell\ , that contains the implant's path , and whenever powershell pro…☆84Aug 2, 2023Updated 3 years ago
- ☆11Sep 11, 2023Updated 3 years ago
- ☆142Jun 21, 2023Updated 3 years ago
- abusing Process Hacker driver to terminate other processes (BYOVD)☆83May 23, 2023Updated 3 years ago
- ☆19Jul 23, 2023Updated 3 years ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- Interactive program for loading AES encrypted shellcode with Dynamic Invocation, and interactive .NET assemblies in memory.☆12Mar 16, 2022Updated 4 years ago
- Demonstration of Early Bird APC Injection - MITRE ID T1055.004☆35Oct 31, 2023Updated 2 years ago
- ☆37Jun 5, 2023Updated 3 years ago
- ☆38May 20, 2023Updated 3 years ago
- powershell script i wrote that can suspend an arbitrary process (with limits)☆22Mar 26, 2023Updated 3 years ago
- Modify managed functions from unmanaged code☆53Feb 1, 2024Updated 2 years ago
- ☆563Feb 22, 2024Updated 2 years ago
- BOF implementation of @_EthicalChaos_'s ThreadlessInject project. A novel process injection technique with no thread creation, released a…☆400Jan 9, 2024Updated 2 years ago
- Exploring in-memory execution of .NET☆138Apr 20, 2022Updated 4 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- WTSImpersonator utilizes WTSQueryUserToken to steal user tokens by abusing the RPC Named Pipe "\\pipe\LSM_API_service"☆121Jul 2, 2024Updated 2 years ago
- A collection of weird ways to execute unmanaged code in .NET☆172May 4, 2021Updated 5 years ago
- Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime☆307Aug 2, 2023Updated 3 years ago
- CVE-2021-34527 AddPrinterDriverEx() Privilege Escalation☆23Feb 2, 2026Updated 8 months ago
- Manual Map Your Files, Bypass 100% Runtime.☆11Aug 31, 2022Updated 4 years ago
- Bypass EDR Create TaskServers☆38Dec 24, 2022Updated 3 years ago
- Documents Exfiltration project for fun and educational purposes☆143Oct 10, 2023Updated 3 years ago