Alternatives and similar repositories for Direct-Syscalls-A-journey-from-high-to-low

Users that are interested in Direct-Syscalls-A-journey-from-high-to-low are comparing it to the libraries listed below

• ipSlav / DirtyCLR
  An App Domain Manager Injection DLL PoC on steroids
  ☆179Updated last year
• LloydLabs / shellcode-plain-sight
  Hiding shellcode in plain sight within a large memory region. Inspired by technique used by Raspberry Robin's Roshtyak
  ☆204Updated 2 years ago
• Octoberfest7 / BeatRev
  POC for frustrating/defeating Malware Analysts
  ☆156Updated 3 years ago
• nettitude / Tartarus-TpAllocInject
  ☆192Updated last year
• gabriellandau / EDRSandblast-GodFault
  EDRSandblast-GodFault
  ☆266Updated 2 years ago
• naksyn / ModuleShifting
  Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctype…
  ☆120Updated last year
• mansk1es / GhostFart
  ☆137Updated 2 years ago
• ChoiSG / OneDriveUpdaterSideloading
  Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post
  ☆101Updated 2 years ago
• MaorSabag / SideLoadingDLL
  Do some DLL SideLoading magic
  ☆86Updated last year
• reveng007 / ReflectiveNtdll
  A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…
  ☆174Updated 2 years ago
• naksyn / ProcessStomping
  A variation of ProcessOverwriting to execute shellcode on an executable's section
  ☆147Updated last year
• OccamsXor / Dragnmove
  Infect Shared Files In Memory for Lateral Movement
  ☆195Updated 2 years ago
• cpu0x00 / SharpReflectivePEInjection
  reflectively load and execute PEs locally and remotely bypassing EDR hooks
  ☆160Updated last year
• x42en / sysplant
  Your syscall factory
  ☆124Updated 2 months ago
• vxCrypt0r / AMSI_VEH
  A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…
  ☆164Updated last year
• securifybv / BOFRyptor
  ☆124Updated last year
• WKL-Sec / dcomhijack
  Lateral Movement Using DCOM and DLL Hijacking
  ☆305Updated 2 years ago
• naksyn / DojoLoader
  Generic PE loader for fast prototyping evasion techniques
  ☆236Updated last year
• klezVirus / NimlineWhispers3
  A tool for converting SysWhispers3 syscalls for use with Nim projects
  ☆147Updated 3 years ago
• SECFORCE / SharpWhispers
  C# porting of SysWhispers2. It uses SharpASM to find the code caves for executing the system call stub.
  ☆110Updated 2 years ago
• OtterHacker / SetProcessInjection
  ☆152Updated last year
• d1rkmtrr / AMSI_patch
  Patching AmsiOpenSession by forcing an error branching
  ☆148Updated 2 years ago
• JanielDary / ImmoralFiber
  Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…
  ☆271Updated 11 months ago
• Mr-Un1k0d3r / AMSI-ETW-Patch
  Patch AMSI and ETW
  ☆246Updated last year
• 0prrr / Malwear-Sweet
  Malware?
  ☆74Updated 11 months ago
• rad9800 / FileRenameJunctionsEDRDisable
  ☆157Updated 9 months ago
• itm4n / PPLrevenant
  Bypass LSA protection using the BYODLL technique
  ☆168Updated 11 months ago
• racoten / BetterNetLoader
  A version of NetLoader, Execute Assemblies and Bypass ETW and AMSI using Hardware Breakpoints
  ☆114Updated 2 months ago
• Octoberfest7 / Secure_Stager
  An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution
  ☆192Updated 9 months ago
• 0xJs / BYOVD_read_write_primitive
  Proof of Concepts code for Bring Your Own Vulnerable Driver techniques
  ☆175Updated 3 weeks ago