daddycocoaman / dumpscan
Finding secrets in kernel and user memory
☆115Updated last year
Alternatives and similar repositories for dumpscan:
Users that are interested in dumpscan are comparing it to the libraries listed below
- ☆116Updated last year
- ☆135Updated last year
- Detect strange memory regions and DLLs☆183Updated 3 years ago
- POC for frustrating/defeating Malware Analysts☆154Updated 2 years ago
- Experiment on reproducing Obfuscate & Sleep☆143Updated 4 years ago
- ☆113Updated 2 years ago
- Simple EDR implementation to demonstrate bypass☆172Updated 4 years ago
- ☆180Updated last year
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆122Updated 2 years ago
- ShellWasp is a tool to help build shellcode that utilizes Windows syscalls, while overcoming the portability problem associated with Wind…☆166Updated last year
- Deleting Shadow Copies In Pure C++☆114Updated 2 years ago
- Identify and exploit leaked handles for local privilege escalation.☆106Updated last year
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆51Updated last year
- Evasion Escaper is a project aimed at evading the checks that malicious software performs to detect if it's running in a virtual environm…☆106Updated 2 months ago
- Embedder is a collection of sources in different languages to embed Python interpreter with minimal dependencies☆118Updated 10 months ago
- ☆79Updated last year
- Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctype…☆114Updated last year
- Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged☆86Updated 2 years ago
- A variation of ProcessOverwriting to execute shellcode on an executable's section☆148Updated last year
- A basic meterpreter protocol stager using the libpeconv library by hasherezade for reflective loading☆83Updated 2 years ago
- ETW based POC to identify direct and indirect syscalls☆185Updated last year
- ☆138Updated 2 years ago
- Detect EDR's exceptions by inspecting processes' loaded modules☆129Updated last year
- Do some DLL SideLoading magic☆82Updated last year
- Utilizing hardware breakpoints to evade monitoring by Endpoint Detection and Response platforms☆126Updated 2 years ago
- RDLL for Cobalt Strike beacon to silence sysmon process☆88Updated 2 years ago
- Windows Persistence IT-Security☆97Updated last month
- Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider☆171Updated 2 years ago
- Patch AMSI and ETW in remote process via direct syscall☆81Updated 2 years ago
- This repo will contain the core detection, only for Cobaltstrike's leaked versions. Non-leaked version detections wont be shared☆89Updated last year