ahkeur / VEH2Links
A Patchless AMSI Bypass Technique using VEH²
☆29Updated 5 months ago
Alternatives and similar repositories for VEH2
Users that are interested in VEH2 are comparing it to the libraries listed below
Sorting:
- Modify managed functions from unmanaged code☆53Updated last year
- Playing with packets in C#☆15Updated last year
- C# API for Nidhogg rootkit☆20Updated last year
- Remap ntdll.dll using only NTAPI functions with a suspended process☆26Updated 7 months ago
- early cascade injection PoC based on Outflanks blog post, in rust☆61Updated last year
- An Aggressor Script that utilizes NtCreateUserProcess to run binaries☆30Updated 9 months ago
- A C# implementation of dumping credentials from Windows Credential Manager☆60Updated 2 years ago
- Just another ntdll unhooking using Parun's Fart technique☆75Updated 2 years ago
- Your NTDLL vaccine from modern direct syscall methods.☆36Updated 3 years ago
- A powerful Windows UI monitoring and DNS exfiltration tool written in Rust, combining advanced UI event capture capabilities with secure …☆19Updated 8 months ago
- ☆11Updated 2 years ago
- Post-Ex BOF tooling for Hannibal☆24Updated last year
- https://github.com/janoglezcampos/c_syscalls with the ASM rewritten by myself for Visual Studio's Compiler.☆31Updated last year
- Proxy function calls through the thread pool with ease☆30Updated 8 months ago
- Hooked create process injection for meterpreter☆23Updated 4 years ago
- a demo module for the kaine agent to execute and inject assembly modules☆42Updated last year
- ☆32Updated 10 months ago
- yet another sleep encryption thing. also used the default github repo name for this one.☆69Updated 2 years ago
- Read ETW Provider events. Inspired by ETWExplorer by Pavel Yosifovich☆17Updated last year
- miscellaneous codes☆36Updated 2 years ago
- Example of using Sleep to create better named pipes.☆41Updated 2 years ago
- A work in progress BOF/COFF loader in Rust☆50Updated 2 years ago
- PoC to self-delete a binary in C#☆34Updated last year
- FrostLock Injection is a freeze/thaw-based code injection technique that uses Windows Job Objects to temporarily freeze (suspend) a targe…☆31Updated 7 months ago
- Shellcode Loader Utilizing ETW Events☆67Updated 8 months ago
- Self Delete DLL☆23Updated last year
- idk man this was the default github name☆35Updated 2 years ago
- Patches the AmsiScan function in clr.dll allowing for unrestricted assembly loading in .NET☆46Updated 6 months ago
- ☆42Updated 9 months ago
- A proof of concept AMSI & ETW bypass using trampolines for hooking and modifying execution flow☆17Updated 4 months ago