Alternatives and similar repositories for TrollUAC

Users that are interested in TrollUAC are comparing it to the libraries listed below

• MzHmO / DebugAmsi
  DebugAmsi is another way to bypass AMSI through the Windows process debugger mechanism.
  ☆98Updated last year
• 0xv1n / RemoteSessionEnum
  Remotely Enumerate sessions using undocumented Windows Station APIs
  ☆119Updated last year
• cybersectroll / SharpPersistSD
  ☆90Updated last year
• Idov31 / NidhoggScript
  NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg
  ☆46Updated last year
• decoder-it / ChgPass
  ☆133Updated 6 months ago
• mlcsec / EDRenum-BOF
  Identify common EDR processes, directories, and services. Simple BOF of Invoke-EDRChecker.
  ☆122Updated 10 months ago
• Octoberfest7 / Enumprotections_BOF
  A BOF to enumerate system process, their protection levels, and more.
  ☆119Updated 9 months ago
• Karkas66 / CelestialSpark
  Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …
  ☆103Updated 5 months ago
• almounah / superdeye
  Indirect Syscall with TartarusGate Approach in Go
  ☆128Updated last month
• nixpal / shellsilo
  SHELLSILO is a cutting-edge tool that translates C syntax into syscall assembly and its corresponding shellcode. It streamlines the proce…
  ☆139Updated 3 weeks ago
• TierZeroSecurity / edr_blocker
  Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…
  ☆140Updated last year
• naksyn / ProcessStomping
  A variation of ProcessOverwriting to execute shellcode on an executable's section
  ☆148Updated last year
• boku7 / patchwerk
  BOF that finds all the Nt* system call stubs within NTDLL and overwrites with clean syscall stubs (user land hook evasion)
  ☆187Updated 6 months ago
• OtterHacker / SetProcessInjection
  ☆152Updated last year
• jakobfriedl / BenevolentLoader
  Shellcode loader using direct syscalls via Hell's Gate and payload encryption.
  ☆91Updated last year
• almounah / go-buena-clr
  Good CLR Host with Native patchless AMSI Bypass
  ☆87Updated 4 months ago
• rasta-mouse / SpawnWith
  ☆110Updated 6 months ago
• blackarrowsec / Handly
  Abuse leaked token handles.
  ☆132Updated last year
• netero1010 / SCCMVNC
  A tool to modify SCCM remote control settings on the client machine, enabling remote control without permission prompts or notifications.…
  ☆95Updated 10 months ago
• fanbyprinciple / bin2shellcode
  .bin file to shellcode convertor
  ☆38Updated last year
• synacktiv / DLHell
  Local & remote Windows DLL Proxying
  ☆165Updated last year
• cybersectroll / TrollDump
  ☆82Updated last year
• NtDallas / Svartalfheim
  Stage 0
  ☆163Updated 8 months ago
• vxCrypt0r / AMSI_VEH
  A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…
  ☆162Updated last year
• Octoberfest7 / enumhandles_BOF
  ☆124Updated 11 months ago
• OmriBaso / WTSImpersonator
  WTSImpersonator utilizes WTSQueryUserToken to steal user tokens by abusing the RPC Named Pipe "\\pipe\LSM_API_service"
  ☆119Updated last year
• Diverto / IPPrintC2
  PoC for using MS Windows printers for persistence / command and control via Internet Printing
  ☆148Updated last year
• ZephrFish / QoL-BOFs
  Curated list of public Beacon Object Files(BOFs) build in as submodules for easy cloning
  ☆132Updated 4 months ago
• mlcsec / FormThief
  Spoofing desktop login applications with WinForms and WPF
  ☆176Updated last year
• nocerainfosec / TakeMyRDP2.0
  An updated version of keystroke logger targeting the Remote Desktop Protocol (RDP) related processes, It utilizes a low-level keyboard in…
  ☆104Updated 2 years ago