Patchless ETW & AMSI bypass POC reverse-engineered from Turla’s Kazuar v3 loader.
☆24Jan 14, 2026Updated 9 months ago
Alternatives and similar repositories for PatchlessEtwAndAmsiBypass
Users that are interested in PatchlessEtwAndAmsiBypass are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- RISC-V VM based shellcode loader PoC - Still WIP☆38Aug 1, 2026Updated 2 months ago
- Detects Module Stomping as implemented by Cobalt Strike☆17Dec 13, 2020Updated 5 years ago
- One-pass anonymous Active Directory enumeration over SAMR and LSARPC — null session, no credentials, with structured reusable output.☆69Sep 17, 2026Updated last month
- Proof of Concept for Process Code Injection Without Using WriteProcessMemory☆151Sep 27, 2026Updated 3 weeks ago
- Offensive PoC tool for BTR.sys - Microsoft Defender's Boot Time Removal Tool. Supporting material for the BTR Reforged research (Black Ha…☆146Aug 20, 2026Updated last month
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Run unsigned kernel payloads in a signed kernel driver via wasm3. No JIT/W^x (HVCI/etc., compliant)☆152Aug 18, 2026Updated 2 months ago
- Patch (block) whatever function you want in a remote process. Adding a ret instruction at the first memory address of this function, the …☆13Jul 11, 2024Updated 2 years ago
- Raw NTFS volume oracle: locked-file read and offline SAM hashes without LSASS☆62Jul 22, 2026Updated 2 months ago
- Prime a process for injection when S1 is present☆13Feb 8, 2025Updated last year
- SilentChrome-BOF installs Chromium extension, native messaging, and Isolated Web App profile artifacts☆52Aug 10, 2026Updated 2 months ago
- EQGRP: Replicating DarkPulsar, an DLL capable of hooking Security Package Method Tables on the Heap!☆15Oct 11, 2020Updated 6 years ago
- A simple C++ driver base with KD data block☆11Jun 25, 2022Updated 4 years ago
- A stealth-focused kernel-mode virtual HID mouse driver for Windows. Built with KMDF and VHF for precise, hardware-level input simulation …☆49Jul 27, 2026Updated 2 months ago
- Post-ex tool to interact with chromium browser when CDP is enabled☆47May 15, 2026Updated 5 months ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- BOF and research notes from hunting execution paths, covering Shell.HWEventHandlerShellExecute COM execution through the AutoPlay IHWEven…☆39Jun 20, 2026Updated 3 months ago
- Beacon Object File (BOF) implementation of the dnscmd.exe functionality used to obtain remote code execution on an ADIDNS server by explo…☆57Jul 8, 2026Updated 3 months ago
- Windows Kernel-Mode Shellcode Development Framework (WKMSDF)☆79Aug 1, 2026Updated 2 months ago
- Remap ntdll.dll using only NTAPI functions with a suspended process☆28Apr 13, 2025Updated last year
- Samples for the article "Interception and modifying TCP connections from kernel on Windows and Linux systems"☆14Jun 30, 2026Updated 3 months ago
- Stack spoofing Detection for CET processes by comparing shadow and user stacks.☆41May 22, 2026Updated 4 months ago
- Busybox-style Beacon Object Files for *nix post-exploitation. Reimplements common Unix utilities as BOFs for use in stripped environments…☆45Jun 14, 2026Updated 4 months ago
- modern c++ wrapper around the microsoft portable executable file format without any crt dependencies and dynamic allocations☆15Dec 30, 2024Updated last year
- Erebus is a payload generator written in Nim.☆19Jun 13, 2023Updated 3 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Latency x-ray for undocumented hardware☆143Aug 11, 2026Updated 2 months ago
- PIC shellcode agent based on Stardust framework and Crystal Palace☆92Oct 4, 2026Updated 2 weeks ago
- Windows kernel driver and usermode app emulator for x86-64 and ARM64 targets.☆171Updated this week
- A CET-compatible Windows x64 loader that produces fully backed call stacks through runtime function table manipulation, code cave injecti…☆134Sep 6, 2026Updated last month
- Crystal Palace library for proxying Nt API calls via the Threadpool. Updated for call gadgets.☆23Nov 11, 2025Updated 11 months ago
- It’s just a reflektor☆37Oct 4, 2026Updated 2 weeks ago
- BOF exploiting the Visual Studio Installer Elevation Service for SYSTEM LPE and persistence via AppDomainManager hijacking, with native E…☆88Aug 5, 2026Updated 2 months ago
- Demonstration of the DLL party process injection technique☆87Oct 1, 2026Updated 2 weeks ago
- Custom Adaptix-compatible C2 agent - PIC beacon + Stardust UDRL + Go extender plugins☆144Oct 4, 2026Updated 2 weeks ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- WasmForge — compile Go and C# programs to single-binary, WASM-sandboxed native executables with polymorphic output.☆134Jun 24, 2026Updated 3 months ago
- Filesystem interaction via firebeam virtual machine execution☆59Mar 26, 2026Updated 6 months ago
- A single byte modification in the kernel memory bypasses and disables all core functions of the AV/EDR security solutions☆18Aug 26, 2025Updated last year
- Proof-of-concept exploit chain (CVE-2026-47301) for Microsoft Configuration Manager (SCCM), combining a broken access, CAB arbitrary-writ…☆108Aug 16, 2026Updated 2 months ago
- mash hypervisor host pml4☆16Jun 22, 2022Updated 4 years ago
- Rust C2 agent for Mythic that produces polymorphic shellcode: per-build function shuffle + ChaCha20-encrypted data sections; no_std/no_ma…☆76May 13, 2026Updated 5 months ago
- A POC for Windows Extension Host hooking☆25Jul 13, 2019Updated 7 years ago