Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advanced evasion techniques against modern EDR systems. It shifts away from traditional signature-based obfuscation towards behavioral camouflage.
☆119Sep 17, 2026Updated last month
Alternatives and similar repositories for Project-Onyx
Users that are interested in Project-Onyx are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆72Jul 12, 2026Updated 3 months ago
- BingusLdr is a DLL loader built with Crystal Palace that uses a CET compatible stack spoofing technique.☆116Jul 14, 2026Updated 3 months ago
- A stealthy stager designed for shellcode payloads staged with http/https like Sliver, or on github raw.☆64Jul 20, 2026Updated 3 months ago
- Usermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more.☆91Jun 15, 2026Updated 4 months ago
- ☆16Jan 15, 2026Updated 9 months ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- NØW is a word-based shellcode encoding and obfuscation tool that transforms raw shellcode bytes into natural-looking English prose.☆92Jun 24, 2026Updated 3 months ago
- ☆107Sep 18, 2026Updated last month
- A Windows x64 offensive research framework that constructs fully synthetic call stacks☆73Jul 14, 2026Updated 3 months ago
- Proof of concept exploit for CVE-2026-3775/CVE-2026-3780 and CVE-2026-57239 which lets you obtain NT AUTHORITY\SYSTEM rights via the Foxi…☆16Jul 27, 2026Updated 2 months ago
- Crystal Palace PICO loader for Sliver C2 dual-layer AMSI bypass, ETW silencing, AES-256-CBC encrypted payloads, 6 delivery variants☆47Aug 20, 2026Updated 2 months ago
- A compiled language for Windows position-independent x86-64 shellcode and Beacon Object Files.☆316Jun 28, 2026Updated 3 months ago
- A foundational C library for building operationally credible offensive capabilities☆94Sep 21, 2026Updated last month
- Phantom-Evasion-Loader is a standalone, pure x64 Assembly injection engine engineered to minimize the detection surface of modern EDR/XDR…☆114Aug 8, 2026Updated 2 months ago
- P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an executi…☆241Jul 8, 2026Updated 3 months ago
- Simple, predictable pricing with DigitalOcean hosting • AdAlways know what you'll pay with monthly caps and flat pricing. Enterprise-grade infrastructure trusted by 600k+ customers.
- Activation Context Hijacking Evasion Tool☆314Jun 17, 2026Updated 4 months ago
- Cloud dead-drop C2 framework — RSA-4096 + AES-256-GCM, 5 cloud providers, Rust-only agents, P2P mesh, persistence engine, credential harv…☆44Updated this week
- Automatically deploying Mythic C2 in Azure using Terraform☆25Jul 3, 2026Updated 3 months ago
- Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender.☆28Jul 14, 2026Updated 3 months ago
- Rust C2 agent for Mythic that produces polymorphic shellcode: per-build function shuffle + ChaCha20-encrypted data sections; no_std/no_ma…☆76May 13, 2026Updated 5 months ago
- Stealthy .NET assembly loading using AssemblyNative::LoadFromBuffer☆59Mar 22, 2026Updated 7 months ago
- DynLoader A modular Windows loader focused on EDR evasion Built with indirect syscall (Tartarus Gate / Hell’s Gate), Manual PE parsing …☆82Jul 10, 2026Updated 3 months ago
- A Rust version of Mirage, a PoC memory evasion technique that relies on a vulnerable VBS enclave to hide shellcode within VTL1.☆40Mar 6, 2025Updated last year
- Modular post-exploitation framework for authorised red-team work. Interactive reverse/bind shells over TCP/TLS/mTLS, plus a pull-based Go…☆38Oct 7, 2026Updated 2 weeks ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Staged DLL injection proof-of-concept built in C using Win32 APIs — developed in an isolated lab environment for red team certification s…☆42Jun 4, 2026Updated 4 months ago
- Proof of concept to detect module stomping detection by looking for modified .pdata sections.☆41Jun 11, 2026Updated 4 months ago
- A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Slee…☆112Jul 26, 2026Updated 2 months ago
- Modify machine code in binaries with alternative x64 assembly opcodes for AV evasion☆252Sep 11, 2026Updated last month
- Crystal port of GodPotato to abuse SeImpersonatePrivilege with indirect syscalls, dynamic API resolution and compile-time string obfuscat…☆131Aug 22, 2026Updated 2 months ago
- Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, S…☆140Aug 13, 2026Updated 2 months ago
- COM Windows Persistence Technique☆90Apr 27, 2026Updated 5 months ago
- Evade behavioral analysis by executing malicious code within trusted Microsoft call stacks, patchless hooking library IAT/EAT.☆149Dec 8, 2025Updated 10 months ago
- A BOF designed to inspect processes memory and addresses☆42Apr 19, 2026Updated 6 months ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- A fileless C2 framework written in pure x64 Linux Assembly with zero libc dependencies. Features dynamic protocol pivoting between raw IC…☆99Oct 2, 2026Updated 3 weeks ago
- A zero-symbol static analysis engine that extracts and mathematically ranks the Windows RPC attack surface using an AHP-based risk model.☆15Aug 26, 2026Updated last month
- ☆91Sep 3, 2026Updated last month
- BYOVD hunter to help prioritize windows drivers worth manual analysis☆134Aug 19, 2025Updated last year
- Custom Adaptix-compatible C2 agent - PIC beacon + Stardust UDRL + Go extender plugins☆146Oct 4, 2026Updated 2 weeks ago
- A Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes.☆31Aug 12, 2026Updated 2 months ago
- Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.☆107Oct 1, 2026Updated 3 weeks ago