Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advanced evasion techniques against modern EDR systems. It shifts away from traditional signature-based obfuscation towards behavioral camouflage.
☆119Sep 17, 2026Updated last month
Alternatives and similar repositories for Project-Onyx
Users that are interested in Project-Onyx are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆72Jul 12, 2026Updated 4 months ago
- BingusLdr is a DLL loader built with Crystal Palace that uses a CET compatible stack spoofing technique.☆118Jul 14, 2026Updated 3 months ago
- Usermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more.☆91Jun 15, 2026Updated 4 months ago
- A stealthy stager designed for shellcode payloads staged with http/https like Sliver, or on github raw.☆64Jul 20, 2026Updated 3 months ago
- NØW is a word-based shellcode encoding and obfuscation tool that transforms raw shellcode bytes into natural-looking English prose.☆92Jun 24, 2026Updated 4 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- ☆16Jan 15, 2026Updated 9 months ago
- A foundational C library for building operationally credible offensive capabilities☆95Sep 21, 2026Updated last month
- ☆108Sep 18, 2026Updated last month
- Crystal Palace PICO loader for Sliver C2 dual-layer AMSI bypass, ETW silencing, AES-256-CBC encrypted payloads, 6 delivery variants☆48Aug 20, 2026Updated 2 months ago
- A Windows x64 offensive research framework that constructs fully synthetic call stacks☆76Jul 14, 2026Updated 3 months ago
- A compiled language for Windows position-independent x86-64 shellcode and Beacon Object Files.☆324Jun 28, 2026Updated 4 months ago
- Proof of concept exploit for CVE-2026-3775/CVE-2026-3780 and CVE-2026-57239 which lets you obtain NT AUTHORITY\SYSTEM rights via the Foxi…☆17Jul 27, 2026Updated 3 months ago
- Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender.☆30Jul 14, 2026Updated 3 months ago
- Activation Context Hijacking Evasion Tool☆315Jun 17, 2026Updated 4 months ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Slee…☆113Jul 26, 2026Updated 3 months ago
- Phantom-Evasion-Loader is a standalone, pure x64 Assembly injection engine engineered to minimize the detection surface of modern EDR/XDR…☆117Aug 8, 2026Updated 3 months ago
- Stealthy .NET assembly loading using AssemblyNative::LoadFromBuffer☆59Mar 22, 2026Updated 7 months ago
- A Rust version of Mirage, a PoC memory evasion technique that relies on a vulnerable VBS enclave to hide shellcode within VTL1.☆40Mar 6, 2025Updated last year
- DynLoader A modular Windows loader focused on EDR evasion Built with indirect syscall (Tartarus Gate / Hell’s Gate), Manual PE parsing …☆82Jul 10, 2026Updated 4 months ago
- Automatically deploying Mythic C2 in Azure using Terraform☆25Jul 3, 2026Updated 4 months ago
- Modular post-exploitation framework for authorised red-team work. Interactive reverse/bind shells over TCP/TLS/mTLS, plus a pull-based Go…☆39Oct 7, 2026Updated last month
- Staged DLL injection proof-of-concept built in C using Win32 APIs — developed in an isolated lab environment for red team certification s…☆42Jun 4, 2026Updated 5 months ago
- Rust C2 agent for Mythic that produces polymorphic shellcode: per-build function shuffle + ChaCha20-encrypted data sections; no_std/no_ma…☆75May 13, 2026Updated 5 months ago
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Proof of concept to detect module stomping detection by looking for modified .pdata sections.☆41Jun 11, 2026Updated 5 months ago
- COM Windows Persistence Technique☆91Apr 27, 2026Updated 6 months ago
- Modify machine code in binaries with alternative x64 assembly opcodes for AV evasion☆267Sep 11, 2026Updated 2 months ago
- A BOF designed to inspect processes memory and addresses☆43Apr 19, 2026Updated 6 months ago
- Evade behavioral analysis by executing malicious code within trusted Microsoft call stacks, patchless hooking library IAT/EAT.☆150Dec 8, 2025Updated 11 months ago
- ☆91Sep 3, 2026Updated 2 months ago
- Windows User-Mode Shellcode Development Framework (WUMSDF)☆163Jul 15, 2026Updated 3 months ago
- BYOVD hunter to help prioritize windows drivers worth manual analysis☆134Aug 19, 2025Updated last year
- Erebus is an Initial Access wrapper for the Mythic Command & Control Server. It converts shellcode into payloads specifically used for ph…☆244Sep 13, 2026Updated last month
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an executi…☆247Jul 8, 2026Updated 4 months ago
- A zero-symbol static analysis engine that extracts and mathematically ranks the Windows RPC attack surface using an AHP-based risk model.☆16Aug 26, 2026Updated 2 months ago
- A fileless C2 framework written in pure x64 Linux Assembly with zero libc dependencies. Features dynamic protocol pivoting between raw IC…☆102Oct 2, 2026Updated last month
- Repository hosting a hypothetical EDR Spoofer, as discovered originally by Nightmare-Eclipse☆44May 27, 2026Updated 5 months ago
- .NET CLR-Stomping☆149May 20, 2026Updated 5 months ago
- BOF with Synthetic Stackframe☆278Oct 30, 2025Updated last year
- WasmForge — compile Go and C# programs to single-binary, WASM-sandboxed native executables with polymorphic output.☆134Jun 24, 2026Updated 4 months ago
Are these results useful?