c3l3si4n / windows_sleep_techniquesLinks
A collections of methods to sleep on Windows using common and less-so-common techniques
☆14Updated last year
Alternatives and similar repositories for windows_sleep_techniques
Users that are interested in windows_sleep_techniques are comparing it to the libraries listed below
Sorting:
- 「⚠️」Performing a BYOVD on the truesight.sys driver☆44Updated 11 months ago
- Using the Counter Strike 1.6 RCON protocol as a C2 Channel.☆86Updated 9 months ago
- Bypass the Event Trace Windows(ETW) and unhook ntdll.☆115Updated 2 years ago
- Another approach of Threadless injection discovered by @_EthicalChaos_ in c that loads a module into the target process and stomps it, an…☆181Updated 2 years ago
- A bunch of scripts and code i wrote.☆144Updated last year
- Splitting and executing shellcode across multiple pages☆103Updated 2 years ago
- 「⚔️」Ring 0 Rootkit for Linux Kernels x86/x86_64 5.x/6.x☆26Updated 7 months ago
- This is a simple process injection made in C for Linux systems☆29Updated 2 years ago
- ☆151Updated 2 years ago
- 「🧊」Ring 3 Rootkit for Windows 10☆59Updated 11 months ago
- Basic interactive Windows kernel offensive toolkit written in C☆133Updated 2 months ago
- Shellcode loader using direct syscalls via Hell's Gate and payload encryption.☆99Updated last year
- Create Anti-Copy DRM Malware☆69Updated last year
- random code snippets, useful for getting started☆121Updated last year
- A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…☆165Updated last year
- Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks☆132Updated 11 months ago
- Section-based payload obfuscation technique for x64☆64Updated last year
- ☆145Updated last year
- Remote Shellcode Injector☆220Updated 2 years ago
- Indirect Syscall implementation to bypass userland NTAPIs hooking.☆84Updated last year
- Collection of red team techniques.☆62Updated 7 months ago
- Bypass user-land hooks by syscall tampering via the Trap Flag☆134Updated 3 months ago
- Mirage is a PoC memory evasion technique that relies on a vulnerable VBS enclave to hide shellcode within VTL1.☆103Updated 9 months ago
- Bypass LSA protection using the BYODLL technique☆170Updated last year
- PE obfuscator with Evasion in mind☆214Updated 2 years ago
- Dynamic shellcode loader with sophisticated evasion capabilities☆260Updated last month
- ☆201Updated 2 years ago
- "Service-less" driver loading☆163Updated last year
- A process injection technique using only thread context manipulation☆39Updated last year
- Another version of .NET loader provides capabilities of bypassing ETW and AMSI, utilizing VEH for syscalls and loading .NET assemblies☆49Updated 4 months ago