daddycocoaman / dumpscan
Finding secrets in kernel and user memory
☆115Updated last year
Alternatives and similar repositories for dumpscan:
Users that are interested in dumpscan are comparing it to the libraries listed below
- ☆119Updated last year
- POC for frustrating/defeating Malware Analysts☆154Updated 2 years ago
- Detect strange memory regions and DLLs☆183Updated 3 years ago
- Simple EDR implementation to demonstrate bypass☆172Updated 4 years ago
- ☆136Updated last year
- ShellWasp is a tool to help build shellcode that utilizes Windows syscalls, while overcoming the portability problem associated with Wind…☆167Updated last year
- This project is an implant framework designed for long term persistent access to Windows machines.☆110Updated last year
- It's pointy and it hurts!☆125Updated 2 years ago
- different ntdll unhooking techniques : unhooking ntdll from disk, from KnownDlls, from suspended process, from remote server (fileless)☆188Updated last year
- MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.☆209Updated 2 years ago
- ☆113Updated 2 years ago
- ☆140Updated 2 years ago
- EDRSandblast-GodFault☆261Updated last year
- Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider☆171Updated 2 years ago
- Tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows☆208Updated 2 years ago
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆51Updated last year
- Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged☆86Updated 2 years ago
- A fake AMSI Provider which can be used for persistence.☆150Updated 3 years ago
- Experiment on reproducing Obfuscate & Sleep☆144Updated 4 years ago
- Hookers are cooler than patches.☆169Updated 3 years ago
- Small PoC of using a Microsoft signed executable as a lolbin.☆137Updated 2 years ago
- A collection of various and sundry code snippets that leverage .NET dynamic tradecraft☆142Updated 11 months ago
- Simple EDR that injects a DLL into a process to place a hook on specific Windows API☆90Updated last year
- Deleting Shadow Copies In Pure C++☆114Updated 2 years ago
- ☆116Updated 3 years ago
- A basic meterpreter protocol stager using the libpeconv library by hasherezade for reflective loading☆84Updated 2 years ago
- ☆184Updated last year
- ☆216Updated 2 years ago
- Utilizing hardware breakpoints to evade monitoring by Endpoint Detection and Response platforms☆127Updated 2 years ago
- Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctype…☆116Updated last year