Small POC written in C# that performs shellcode injection on x64 processes using direct syscalls as a way to bypass user-land EDR hooks.
☆83Dec 20, 2019Updated 6 years ago
Alternatives and similar repositories for directInjectorPOC
Users that are interested in directInjectorPOC are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Simple PoC demonstrating syscall execution in C#☆159Apr 30, 2020Updated 6 years ago
- A C port of b33f's UrbanBishop☆38Oct 1, 2020Updated 6 years ago
- Shellcode injection POC using syscalls.☆116Jun 5, 2020Updated 6 years ago
- Create a C++ PE which loads an XTEA-crypted .NET PE shellcode in memory.☆16Sep 29, 2018Updated 8 years ago
- Create a minidump of the LSASS process from memory☆257Nov 2, 2022Updated 4 years ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- Bypass AMSI and Executing PowerShell scripts from C# - using CyberArk's method to bypass AMSI☆30Feb 22, 2020Updated 6 years ago
- Using DInvoke to patch AMSI.dll in order to bypass AMSI detections triggered when loading .NET tradecraft via Assembly.Load().☆216Mar 5, 2020Updated 6 years ago
- A BOF for enumerating version information for DLLs associated for a Beacon process.☆16Nov 23, 2021Updated 4 years ago
- Reflective DLL Injection with obfuscated (XOR) shellcode☆72Dec 13, 2020Updated 5 years ago
- DInvisibleRegistry☆82Nov 20, 2020Updated 5 years ago
- A set of scripts that demonstrate how to perform memory injection in C#☆318Nov 5, 2017Updated 8 years ago
- .Net Assembly to block ETW telemetry in current process☆78May 14, 2020Updated 6 years ago
- ☆22Aug 11, 2021Updated 5 years ago
- C# Implementation of the Hell's Gate VX Technique☆215Jun 30, 2020Updated 6 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- A simplified version of DotNetToJScript to create a JScript file which loads a .NET v2 assembly from memory.☆47Mar 1, 2021Updated 5 years ago
- This POC provides the possibilty to execute x86 shellcode in form of a .bin file based on x86 inline assembly☆20Apr 17, 2023Updated 3 years ago
- ☆16Sep 23, 2021Updated 5 years ago
- Loads any C# binary in mem, patching AMSI + ETW.☆857Oct 3, 2021Updated 5 years ago
- My CobaltStrike BOFS☆166Jul 23, 2022Updated 4 years ago
- Companion PoC for the "Adventures in Dynamic Evasion" blog post☆127May 25, 2021Updated 5 years ago
- Yet another PoC for https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows☆143Jul 11, 2020Updated 6 years ago
- AMSI Bypass Via the Heap☆106Nov 20, 2020Updated 5 years ago
- PoC to demonstrate how CLR ETW events can be tampered.☆187Mar 26, 2020Updated 6 years ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- C# port of the Get-AppLockerPolicy PS cmdlet☆97Dec 8, 2022Updated 3 years ago
- A simple C implementation to decoded your shellcode and writes it directly to memory☆97Jul 10, 2020Updated 6 years ago
- Beacon Object File allowing creation of Beacons in different sessions.☆84May 23, 2022Updated 4 years ago
- Hide code from dnSpy and other C# spying tools☆42Oct 18, 2020Updated 6 years ago
- Collection of beacon BOF written to learn windows and cobaltstrike☆360Feb 24, 2023Updated 3 years ago
- Executing a .NET Assembly from C++ in Memory (CLR Hosting)☆200Nov 12, 2016Updated 9 years ago
- Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR AppDomainManager, Stomping Loader/.NET assembly PE DOS head…☆598Jul 26, 2021Updated 5 years ago
- dem sharp donuts☆199Sep 11, 2022Updated 4 years ago
- One gate to all syscalls!☆23Mar 12, 2022Updated 4 years ago
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- Extracting Syscall Stub, Modernized☆65Apr 2, 2022Updated 4 years ago
- .NET assembly local/remote loading/injection into memory.☆133Aug 2, 2019Updated 7 years ago
- D/Invoke port of UrbanBishop☆109Jul 19, 2020Updated 6 years ago
- Command line interface to dump LSASS memory to disk via SilentProcessExit☆458Dec 23, 2020Updated 5 years ago
- ** DISCONTINUED ** C2 framework that uses Background Intelligent Transfer Service (BITS) as communication protocol and Direct Syscalls + …☆222Dec 8, 2022Updated 3 years ago
- Upsilon execute shellcode with syscalls - no API like NtProtectVirtualMemory is used☆90Aug 26, 2021Updated 5 years ago
- A proof of concept of real custom GetProcAddress and GetModuleBaseAddress☆20Jul 9, 2022Updated 4 years ago