ScriptIdiot / sleepmask_PatchlessHook
Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW
☆82Updated last year
Alternatives and similar repositories for sleepmask_PatchlessHook:
Users that are interested in sleepmask_PatchlessHook are comparing it to the libraries listed below
- Basic implementation of Cobalt Strikes - User Defined Reflective Loader feature☆96Updated last year
- ☆77Updated last year
- Modified versions of the Cobalt Strike Process Injection Kit☆90Updated 11 months ago
- Threadless shellcode injection tool☆62Updated 5 months ago
- ☆92Updated 4 months ago
- In-memory sleep encryption and heap encryption for Go applications through a shellcode function.☆39Updated last year
- Improved version of EKKO by @5pider that Encrypts only Image Sections☆117Updated last year
- ☆122Updated last year
- I have documented all of the AMSI patches that I learned till now☆68Updated last year
- ☆96Updated last year
- ☆111Updated last year
- BOF with Synthetic Stackframe☆58Updated this week
- Cobalt Strike + Brute Ratel C4 Beacon Object File (BOF) Conversion of the Mockingjay Process Injection Technique☆150Updated last year
- DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly☆60Updated 10 months ago
- A simple BOF that frees UDRLs☆114Updated 2 years ago
- Execute dotnet app from unmanaged process☆67Updated 2 weeks ago
- Beacon Object File allowing creation of Beacons in different sessions.☆78Updated 2 years ago
- lsassdump via RtlCreateProcessReflection and NanoDump☆77Updated 3 months ago
- ☆120Updated last year
- ☆73Updated last year
- Alternative Shellcode Execution Via Callbacks in C# with P/Invoke☆75Updated last year
- Tool to bypass LSA Protection (aka Protected Process Light)☆45Updated 2 weeks ago
- ☆138Updated last year
- ☆126Updated last year
- ☆121Updated 4 months ago
- SharpElevator is a C# implementation of Elevator for UAC bypass. This UAC bypass was originally discovered by James Forshaw and publishe…☆50Updated 2 years ago
- A 64-bit, position-independent code reverse TCP shell for Windows — built in Rust.☆51Updated 2 weeks ago
- Library of BOFs to interact with SQL servers☆154Updated last month
- SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application.☆68Updated 8 months ago
- Lateral Movement via the .NET Profiler☆75Updated last month