WhiteOakSecurity / MiniDumpDotNet

Related projects ⓘ

Alternatives and complementary repositories for MiniDumpDotNet

• inb1ts / birdnet-poc
  Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.
  ☆38Updated last year
• peiga / DumpThatLSASS
  Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk , plus functions and strings obfuscation
  ☆29Updated 2 years ago
• synacktiv / AADOutsider-py
  Python3 rewrite of AsOutsider features of AADInternals
  ☆36Updated 2 months ago
• Bl4ckM1rror / PEAs
  ☆58Updated 10 months ago
• cpu0x00 / EternelSuspention
  a simple poc showcasing the ability of an admin to suspend EDR's protected processes , making it useless
  ☆39Updated 4 months ago
• rasta-mouse / PPEnum
  Simple BOF to read the protection level of a process
  ☆104Updated last year
• ScriptIdiot / SysmonQuiet
  RDLL for Cobalt Strike beacon to silence sysmon process
  ☆85Updated 2 years ago
• MaorSabag / Paruns-Fart
  Just another ntdll unhooking using Parun's Fart technique
  ☆72Updated last year
• naksyn / ProcessStomping
  A variation of ProcessOverwriting to execute shellcode on an executable's section
  ☆145Updated 10 months ago
• waawaa / AMSI_Rubeus_bypass
  ☆61Updated 2 years ago
• oldboy21 / JayFinder
  Find DLLs with RWX section
  ☆75Updated last year
• 0xe7 / RoastInTheMiddle
  ☆68Updated last year
• CaptainNox / Hypnos
  A more reliable way of resolving syscall numbers in Windows
  ☆49Updated 9 months ago
• morRubin / NegoExRelay
  ☆83Updated 2 years ago
• ChoiSG / OneDriveUpdaterSideloading
  Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post
  ☆86Updated 2 years ago
• wolfcod / lsassdump
  lsassdump via RtlCreateProcessReflection and NanoDump
  ☆70Updated 3 weeks ago
• mgeeky / msi-shenanigans
  Proof of Concept code and samples presenting emerging threat of MSI installer files.
  ☆77Updated last year
• MaorSabag / SideLoadingDLL
  Do some DLL SideLoading magic
  ☆74Updated last year
• MayerDaniel / profiler-lateral-movement
  Lateral Movement via the .NET Profiler
  ☆74Updated 5 months ago
• Hagrid29 / RemotePatcher
  Patch AMSI and ETW in remote process via direct syscall
  ☆77Updated 2 years ago
• 0xNinjaCyclone / IATUnhooker
  IAT Unhooking proof-of-concept
  ☆28Updated 7 months ago
• xpn / CloudInject
  ☆103Updated 6 months ago
• RedSiege / What-The-F
  This repo hosts a poc of how to execute F# code within an unmanaged process
  ☆65Updated 4 months ago
• boku7 / halosgate-ps
  Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes
  ☆94Updated last year
• reveng007 / AMSI-patches-learned-till-now
  I have documented all of the AMSI patches that I learned till now
  ☆68Updated last year
• tijme / conferences
  Some of the presentations, workshops, and labs I gave at public conferences.
  ☆29Updated 2 months ago
• Wh04m1001 / Random
  Random
  ☆32Updated last year
• OtterHacker / SetProcessInjection
  ☆142Updated last year
• rasta-mouse / MinHook.NET
  A C# port of the MinHook API hooking library
  ☆50Updated 2 years ago