aaaddress1/Windows-APT-Warfare external links

---

GitHub - View repository

GitHub.dev - Open in online code editor

Star history - Growth chart over time

deps.dev - Dependencies and security vulnerabilities

Gitingest - Export source code for LLM usage

Repomix - Export source code for LLM usage

uithub - Export source code for LLM usage

Close

aaaddress1/Windows-APT-Warfare

Readme badge preview -

If you own this repo, copy the snippet below and add it to your README.md

---

Copy

[![RelatedRepos](https://img.shields.io/badge/related-repos-yellow)](https://relatedrepos.com/gh/aaaddress1/Windows-APT-Warfare)

Close

aaaddress1 / Windows-APT-WarfareView on GitHubMore

• External links
• Readme badge

著作《Windows APT Warfare：惡意程式前線戰術指南》各章節技術實作之原始碼內容

☆418Jul 23, 2023Updated 2 years ago

Alternatives and similar repositories for Windows-APT-Warfare

Users that are interested in Windows-APT-Warfare are comparing it to the libraries listed below

• aaaddress1 / wowInjector

  View on GitHub
  PoC: Exploit 32-bit Thread Snapshot of WOW64 to Take Over $RIP & Inject & Bypass Antivirus HIPS (HITB 2021)
  ☆167May 27, 2021Updated 4 years ago
• hasherezade / process_ghosting

  View on GitHub
  Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted fi…
  ☆684Mar 11, 2024Updated last year
• bats3c / DarkLoadLibrary

  View on GitHub
  LoadLibrary for offensive operations
  ☆1,176Oct 22, 2021Updated 4 years ago
• ethereal-vx / Antivirus-Artifacts

  View on GitHub
  Anti-virus artifacts. Listing APIs hooked by: Avira, BitDefender, F-Secure, MalwareBytes, Norton, TrendMicro, and WebRoot.
  ☆754Nov 16, 2021Updated 4 years ago
• mai1zhi2 / SharpBeacon

  View on GitHub
  CobaltStrike Beacon written in .Net 4 用.net重写了stager及Beacon，其中包括正常上线、文件管理、进程管理、令牌管理、结合SysCall进行注入、原生端口转发、关ETW等一系列功能
  ☆730Sep 1, 2021Updated 4 years ago
• Airboi / bypass-av-note

  View on GitHub
  免杀技术大杂烩---乱拳也打不死老师傅
  ☆1,094Mar 29, 2021Updated 4 years ago
• EddieIvan01 / win32api-practice

  View on GitHub
  Offensive tools written for practice purposes
  ☆162Sep 23, 2022Updated 3 years ago
• aaaddress1 / PR0CESS

  View on GitHub
  some gadgets about windows process and ready to use :)
  ☆611Oct 7, 2023Updated 2 years ago
• mai1zhi2 / SysWhispers2_x86

  View on GitHub
  X86 version of syswhispers2 / x86 direct system call
  ☆330Jan 28, 2021Updated 5 years ago
• iammaguire / MeetC2

  View on GitHub
  Modular C2 framework aiming to ease post exploitation for red teamers.
  ☆194May 22, 2022Updated 3 years ago
• aaaddress1 / wowGrail

  View on GitHub
  PoC: Rebuild A New Path Back to the Heaven's Gate (HITB 2021)
  ☆109May 27, 2021Updated 4 years ago
• NoOne-hub / Beacon.dll

  View on GitHub
  Beacon.dll reverse
  ☆141Sep 5, 2021Updated 4 years ago
• LloydLabs / delete-self-poc

  View on GitHub
  A way to delete a locked file, or current running executable, on disk.
  ☆616Nov 5, 2025Updated 4 months ago
• xuanxuan0 / DripLoader

  View on GitHub
  Evasive shellcode loader for bypassing event-based injection detection (PoC)
  ☆822Aug 23, 2021Updated 4 years ago
• aahmad097 / AlternativeShellcodeExec

  View on GitHub
  Alternative Shellcode Execution Via Callbacks
  ☆1,699Nov 11, 2022Updated 3 years ago
• ZanderChang / anti-sandbox

  View on GitHub
  Windows对抗沙箱和虚拟机的方法总结
  ☆401Apr 22, 2020Updated 5 years ago
• hasherezade / transacted_hollowing

  View on GitHub
  Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging
  ☆580Mar 8, 2024Updated 2 years ago
• nettitude / RunPE

  View on GitHub
  C# Reflective loader for unmanaged binaries.
  ☆446Jan 25, 2023Updated 3 years ago
• mai1zhi2 / ShellCodeFramework

  View on GitHub
  绕3环的shellcode免杀框架
  ☆574Mar 19, 2021Updated 4 years ago
• Mr-Un1k0d3r / EDRs

  View on GitHub
  ☆2,168Feb 21, 2023Updated 3 years ago
• hlldz / RefleXXion

  View on GitHub
  RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, …
  ☆500Jan 25, 2022Updated 4 years ago
• Yaxser / COFFLoader2

  View on GitHub
  Load and execute COFF files and Cobalt Strike BOFs in-memory
  ☆226Sep 13, 2022Updated 3 years ago
• med0x2e / SigFlip

  View on GitHub
  SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature…
  ☆1,254Aug 27, 2023Updated 2 years ago
• xuanxuan0 / TiEtwAgent

  View on GitHub
  PoC memory injection detection agent based on ETW, for offensive and defensive research purposes
  ☆301Apr 10, 2021Updated 4 years ago
• Cr4sh / MicroBackdoor

  View on GitHub
  Small and convenient C2 tool for Windows targets
  ☆613Mar 8, 2022Updated 4 years ago
• ChaitanyaHaritash / Callback_Shellcode_Injection

  View on GitHub
  POCs for Shellcode Injection via Callbacks
  ☆411Feb 23, 2021Updated 5 years ago
• rsmudge / unhook-bof

  View on GitHub
  Remove API hooks from a Beacon process.
  ☆282Sep 18, 2021Updated 4 years ago
• Rvn0xsy / Cooolis-ms

  View on GitHub
  Cooolis-ms是一个包含了Metasploit Payload Loader、Cobalt Strike External C2 Loader、Reflective DLL injection的代码执行工具，它的定位在于能够在静态查杀上规避一些我们将要执行且含有特征的…
  ☆929Jan 7, 2026Updated 2 months ago
• aaaddress1 / RunPE-In-Memory

  View on GitHub
  Run a Exe File (PE Module) in memory (like an Application Loader)
  ☆940Mar 28, 2021Updated 4 years ago
• joshfaust / Alaris

  View on GitHub
  A protective and Low Level Shellcode Loader that defeats modern EDR systems.
  ☆917Mar 20, 2024Updated last year
• Hzllaga / JsLoader

  View on GitHub
  js免杀shellcode，绕过杀毒添加自启
  ☆354Mar 16, 2021Updated 4 years ago
• paranoidninja / PIC-Get-Privileges

  View on GitHub
  Building and Executing Position Independent Shellcode from Object Files in Memory
  ☆167Jan 30, 2021Updated 5 years ago
• hasherezade / pe_to_shellcode

  View on GitHub
  Converts PE into a shellcode
  ☆2,747Aug 30, 2025Updated 6 months ago
• kyleavery / inject-assembly

  View on GitHub
  Inject .NET assemblies into an existing process
  ☆507Jan 19, 2022Updated 4 years ago
• 0xpat / COFFInjector

  View on GitHub
  PoC MSVC COFF Object file loader/injector.
  ☆184Mar 19, 2021Updated 4 years ago
• neofito / RpcEndpointMapper

  View on GitHub
  Windows 7/2008 R2 EoP
  ☆13Feb 12, 2021Updated 5 years ago
• itm4n / PPLdump

  View on GitHub
  Dump the memory of a PPL with a userland exploit
  ☆888Jul 24, 2022Updated 3 years ago
• kyleavery / AceLdr

  View on GitHub
  Cobalt Strike UDRL for memory scanner evasion.
  ☆1,006Jun 4, 2024Updated last year
• Rvn0xsy / BadCode

  View on GitHub
  恶意代码逃逸源代码 http://payloads.online
  ☆758Mar 7, 2022Updated 4 years ago