cpu0x00 / Ghost

Related projects ⓘ

Alternatives and complementary repositories for Ghost

• rasta-mouse / OST-C2-Spec
  Open Source C&C Specification
  ☆220Updated 3 weeks ago
• Tylous / Freeze.rs
  Freeze.rs is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls written in RUST
  ☆167Updated last month
• senzee1984 / InflativeLoading
  Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.
  ☆265Updated 7 months ago
• Maldev-Academy / Christmas
  ☆243Updated 9 months ago
• senzee1984 / MutationGate
  Use hardware breakpoint to dynamically change SSN in run-time
  ☆232Updated 7 months ago
• netero1010 / GhostTask
  A tool employs direct registry manipulation to create scheduled tasks without triggering the usual event logs.
  ☆471Updated last year
• 0xEr3bus / PoolPartyBof
  A beacon object file implementation of PoolParty Process Injection Technique.
  ☆321Updated 10 months ago
• zyn3rgy / smbtakeover
  BOF and Python3 implementation of technique to unbind 445/tcp on Windows via SCM interactions
  ☆264Updated 3 months ago
• MalwareTech / EDRception
  A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.
  ☆168Updated 10 months ago
• senzee1984 / EDRPrison
  Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry
  ☆278Updated 3 months ago
• Maldev-Academy / ExecutePeFromPngViaLNK
  Extract and execute a PE embedded within a PNG file using an LNK file.
  ☆213Updated last week
• vxCrypt0r / AMSI_VEH
  A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…
  ☆148Updated 5 months ago
• ricardojoserf / TrickDump
  Dump lsass using only NTAPIS running 3 programs to create 3 JSON and 1 ZIP file... and generate the Minidump later!
  ☆350Updated last month
• icyguider / UAC-BOF-Bonanza
  Collection of UAC Bypass Techniques Weaponized as BOFs
  ☆405Updated 8 months ago
• TunnelGRE / Percino
  Evasive Golang Loader
  ☆130Updated 3 months ago
• icyguider / LatLoader
  PoC module to demonstrate automated lateral movement with the Havoc C2 framework.
  ☆273Updated 11 months ago
• VoldeSec / PatchlessCLRLoader
  .NET assembly loader with patchless AMSI and ETW bypass
  ☆276Updated last year
• Octoberfest7 / Secure_Stager
  An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution
  ☆135Updated 2 weeks ago
• trickster0 / NamelessC2
  Nameless C2 - A C2 with all its components written in Rust
  ☆239Updated last month
• REDMED-X / OperatorsKit
  Collection of Beacon Object Files (BOF) for Cobalt Strike
  ☆531Updated 3 months ago
• RedefiningReality / Cobalt-Strike
  Various resources to enhance Cobalt Strike's functionality and its ability to evade antivirus/EDR detection
  ☆247Updated 5 months ago
• brosck / Reaper
  「💀」Proof of concept on BYOVD attack
  ☆147Updated 8 months ago
• florylsk / ExecIT
  Execute shellcode files with rundll32
  ☆181Updated 9 months ago
• Cipher7 / ChaiLdr
  AV bypass while you sip your Chai!
  ☆206Updated 5 months ago
• 0xsp-SRD / MDE_Enum
  comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reducti…
  ☆190Updated 5 months ago
• WKL-Sec / dcomhijack
  Lateral Movement Using DCOM and DLL Hijacking
  ☆279Updated last year
• EvilBytecode / EDR-XDR-AV-Killer
  Reproducing Spyboy technique, which involves terminating all EDR/XDR/AVs processes by abusing the zam64.sys driver
  ☆241Updated 4 months ago
• rweijnen / createdump
  Leverage WindowsApp createdump tool to obtain an lsass dump
  ☆142Updated last month