Alternatives and similar repositories for SharpGhosting

Users that are interested in SharpGhosting are comparing it to the libraries listed below

• IkerSaint / KingHamlet
  Process Ghosting Tool
  ☆175Updated 4 years ago
• plackyhacker / Suspended-Thread-Injection
  Another meterpreter injection technique using C# that attempts to bypass Defender
  ☆265Updated 4 years ago
• VirtualAlllocEx / Create-Thread-Shellcode-Fetcher
  This POC gives you the possibility to compile a .exe to completely avoid statically detection by AV/EPP/EDR of your C2-shellcode and down…
  ☆256Updated 2 years ago
• waldo-irc / YouMayPasser
  You shall pass
  ☆269Updated 3 years ago
• dr4k0nia / NixImports
  A .NET malware loader, using API-Hashing to evade static analysis
  ☆209Updated 2 years ago
• plackyhacker / SandboxDefender
  C# code to Sandbox Defender (and most probably other AV/EDRs).
  ☆167Updated 3 years ago
• boku7 / HOLLOW
  EarlyBird process hollowing technique (BOF) - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and e…
  ☆291Updated 2 years ago
• APTortellini / DefenderSwitch
  Stop Windows Defender using the Win32 API
  ☆192Updated 3 years ago
• GetRektBoy724 / SharpUnhooker
  C# Based Universal API Unhooker
  ☆411Updated 3 years ago
• NUL0x4C / KnownDllUnhook
  Replace the .txt section of the current loaded modules from \KnownDlls\
  ☆305Updated 3 years ago
• plackyhacker / CmdLineSpoofer
  How to spoof the command line when spawning a new process from C#.
  ☆110Updated 4 years ago
• Wra7h / SingleDose
  Generate Shellcode Loaders & Injects
  ☆159Updated 2 years ago
• N4kedTurtle / PersistBOF
  A BOF to automate common persistence tasks for red teamers
  ☆291Updated 2 years ago
• sailay1996 / CdpSvcLPE
  Windows Local Privilege Escalation via CdpSvc service (Writeable SYSTEM path Dll Hijacking)
  ☆254Updated 3 years ago
• kyleavery / inject-assembly
  Inject .NET assemblies into an existing process
  ☆508Updated 4 years ago
• OmriBaso / RToolZ
  A Stealthy Lsass Dumper - can abuse ProcExp152.sys driver to dump PPL Lsass, no dbghelp.lib calls.
  ☆324Updated 2 years ago
• Wh04m1001 / IDiagnosticProfileUAC
  ☆184Updated 3 years ago
• tasox / CSharp_Process_Injection
  ☆77Updated last year
• trustedsec / SliverKeylogger
  ☆169Updated 2 years ago
• SaadAhla / AMSI_patch
  Patching AmsiOpenSession by forcing an error branching
  ☆154Updated 2 years ago
• SaadAhla / ntdlll-unhooking-collection
  different ntdll unhooking techniques : unhooking ntdll from disk, from KnownDlls, from suspended process, from remote server (fileless)
  ☆201Updated 2 years ago
• pracsec / AmsiBypassHookManagedAPI
  A new AMSI Bypass technique using .NET ALI Call Hooking.
  ☆192Updated 3 years ago
• nettitude / RunPE
  C# Reflective loader for unmanaged binaries.
  ☆444Updated 2 years ago
• TheWover / GhostLoader
  GhostLoader - AppDomainManager - Injection - 攻壳机动队
  ☆162Updated 5 years ago
• antonioCoco / MalSeclogon
  A little tool to play with the Seclogon service
  ☆327Updated 3 years ago
• plackyhacker / Sys-Calls
  An example of using Syscalls in C# to get a meterpreter shell.
  ☆111Updated 4 years ago
• SolomonSklash / SleepyCrypt
  A shellcode function to encrypt a running process image when sleeping.
  ☆340Updated 4 years ago
• Cracked5pider / CoffeeLdr
  Beacon Object File Loader
  ☆294Updated 2 years ago
• oXis / GPUSleep
  Move CS beacon to GPU memory when sleeping
  ☆250Updated 4 years ago
• rasta-mouse / DInvoke
  Dynamically invoke arbitrary unmanaged code from managed code without P/Invoke.
  ☆168Updated last year