ZeroMemoryEx / Overlord
abusing Process Hacker driver to terminate other processes (BYOVD)
☆81Updated last year
Related projects: ⓘ
- This script is used to bypass DLL Hooking using a fresh mapped copy of ntdll file, patch the ETW and trigger a shellcode with process hol…☆67Updated 7 months ago
- Red Team Operation's Defense Evasion Technique.☆50Updated 3 months ago
- Basic implementation of Cobalt Strikes - User Defined Reflective Loader feature☆93Updated last year
- A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge …☆151Updated last year
- ☆60Updated this week
- This is my own implementation of the Perun's Fart technique by Sektor7☆64Updated 2 years ago
- Improved version of EKKO by @5pider that Encrypts only Image Sections☆110Updated last year
- ☆99Updated this week
- ☆68Updated this week
- I have documented all of the AMSI patches that I learned till now☆66Updated last year
- ☆100Updated this week
- ☆107Updated this week
- RDLL for Cobalt Strike beacon to silence sysmon process☆85Updated 2 years ago
- Patch AMSI and ETW in remote process via direct syscall☆78Updated 2 years ago
- Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW☆76Updated last year
- Do some DLL SideLoading magic☆72Updated 11 months ago
- Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.☆32Updated 8 months ago
- ☆87Updated this week
- ☆70Updated last year
- ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption☆79Updated last year
- Beacon Object File allowing creation of Beacons in different sessions.☆73Updated 2 years ago
- ☆43Updated 2 years ago
- Sleep Obfuscation☆39Updated last year
- ☆33Updated last year
- ☆105Updated last year
- DLL Exports Extraction BOF with optional NTFS transactions.☆76Updated 2 years ago
- SharpElevator is a C# implementation of Elevator for UAC bypass. This UAC bypass was originally discovered by James Forshaw and publishe…☆47Updated 2 years ago
- DLL Hijacking and Mock directories technique to bypass Windows UAC security feature and getting high-level privileged reverse shell. Secu…☆35Updated 4 months ago
- Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes☆93Updated last year
- Simple BOF to read the protection level of a process☆101Updated last year