EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response)
☆79Oct 18, 2026Updated 3 weeks ago
Alternatives and similar repositories for PhantomBuffer
Users that are interested in PhantomBuffer are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- This is a project aimed to make every other Saas product a C2, confluence is just the beginning.☆23Oct 21, 2026Updated 2 weeks ago
- Proof of Concept for Process Code Injection Without Using WriteProcessMemory☆161Sep 27, 2026Updated last month
- Another Injection Technique which eliminates creations of thread in remote process☆29Jul 7, 2026Updated 4 months ago
- Cross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.☆69Oct 25, 2026Updated 2 weeks ago
- Demonstration of the DLL party process injection technique☆99Oct 1, 2026Updated last month
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Gain shellcode execution via T4 Text Transform files/TextTransoform.exe☆87Oct 23, 2026Updated 2 weeks ago
- Repository for various Beacon Object Files (BOFs)☆184Oct 22, 2026Updated 2 weeks ago
- ☆76Oct 27, 2026Updated 2 weeks ago
- Cloud dead-drop C2 framework — RSA-4096 + AES-256-GCM, 5 cloud providers, Rust-only agents, P2P mesh, persistence engine, credential harv…☆50Oct 27, 2026Updated 2 weeks ago
- ☆72Jul 12, 2026Updated 3 months ago
- Runtime Credential Guard deactivation via \\LSA_ISO_DISABLE_CREDENTIAL_GUARD + LSASS NT hash extraction (Win11 24H2)☆108Oct 27, 2026Updated 2 weeks ago
- Sleep Obfuscation via CreateThreadpoolTimer☆24Jul 27, 2026Updated 3 months ago
- A PoC tool for the Pass-ta-key Golden Attack, covering the extraction of the Google Password Manager Security Domain Secret from Chrome p…☆40Updated this week
- another PrivEsc potato...☆122Sep 5, 2026Updated 2 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Windows Kernel-Mode Shellcode Development Framework (WKMSDF)☆90Aug 1, 2026Updated 3 months ago
- Sleep replacement that executes real, varied work to break behavioral pattern matching by EDR and anti-cheat systems☆92Jul 20, 2026Updated 3 months ago
- OneDrive as a covert C2 transport for Cobalt Strike☆78Sep 19, 2026Updated last month
- Remote process injection via TP_DIRECT.Callback hijack☆41Oct 30, 2026Updated last week
- A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Slee…☆113Jul 26, 2026Updated 3 months ago
- Clean Indirect Syscalls with Syscall Tampering.☆53Oct 25, 2026Updated 2 weeks ago
- A stealthy process injection PoC combining Thread Name-Calling for payload delivery with Waiting Thread Hijacking for execution, with zer…☆141Oct 30, 2026Updated last week
- BOF and research notes from hunting execution paths, covering Shell.HWEventHandlerShellExecute COM execution through the AutoPlay IHWEven…☆39Jun 20, 2026Updated 4 months ago
- A Position Independent Code (PIC) implementation of the execute-assembly command built with Crystal Palace.☆22Oct 4, 2026Updated last month
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- A PoC of User-Defined Reflective Loader for Havoc Framework built with Cystal Palace☆48Oct 18, 2026Updated 3 weeks ago
- Beacon Object File (BOF) to coerce machine account auth via IPP.☆101Updated this week
- DynLoader A modular Windows loader focused on EDR evasion Built with indirect syscall (Tartarus Gate / Hell’s Gate), Manual PE parsing …☆82Jul 10, 2026Updated 3 months ago
- Modular User-Defined Reflective Loader (UDRL) built on Crystal Palace for controlled DLL execution and evasion research.☆41Apr 14, 2026Updated 6 months ago
- ☆32Oct 22, 2026Updated 2 weeks ago
- ☆37May 19, 2026Updated 5 months ago
- Mythic C2 MSTeams Communication Channel☆42Sep 13, 2026Updated last month
- LPE Proof-of-Concept for Windows 11 abusing TrustedInstaller's Component Based Servicing (CBS) session COM object and junctions for arbit…☆61Nov 1, 2026Updated last week
- Workshop materials for “Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel” presented at DEF CON 34 and BSidesLV 20…☆397Aug 16, 2026Updated 2 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- A workshop about core UDRL mechanics by Joris Ignoul & Mickey De Baets☆23Jun 12, 2026Updated 4 months ago
- EDRUnChoker - fileless WMI defense that removes EDRChoker QoS throttling policies☆49Jun 8, 2026Updated 5 months ago
- Windows x64 API hashing library that bypasses EAF and resolves forwarded exports, ordinals, and api-ms-*/ext-ms-* API Set DLLs.☆71Oct 7, 2026Updated last month
- Collection of reversed vulnerable drivers weaponized into process killers. PPL won't save you.☆116Oct 18, 2026Updated 3 weeks ago
- CVE-2026-97798 Windows Error Reporting - Command Injection TO SYSTEM☆68Oct 30, 2026Updated last week
- Modified BloodHound.py CE ingestor for red team use. Obfuscates LDAP through ldapx, paces LDAP searches and host RPC, and resumes a stopp…☆94Oct 10, 2026Updated 3 weeks ago
- AdaptixC2 default beacon agent extended to support Crystal Palace loaders.☆66May 4, 2026Updated 6 months ago
Are these results useful?