Alternatives and similar repositories for CreateFile_based_rootkit

Users that are interested in CreateFile_based_rootkit are comparing it to the libraries listed below

• ioncodes / CVE-2020-16938
  Bypassing NTFS permissions to read any files as unprivileged user.
  ☆188Updated 4 years ago
• NtRaiseHardError / NINA
  NINA: No Injection, No Allocation x64 Process Injection Technique
  ☆225Updated 5 years ago
• t3rabyt3-zz / Gozi
  Gozi ISFB is a well-known and widely distributed banking trojan, and has been in the threat landscape for the past several years.
  ☆65Updated 7 years ago
• uf0o / rootkit-arsenal-guacamole
  An attempt to restore and adapt to modern Win10 version the 'Rootkit Arsenal' original code samples
  ☆70Updated 3 years ago
• Maff1t / WindowsPermsPoC
  A simple PoC to demonstrate that is possible to write Non writable memory and execute Non executable memory on Windows
  ☆53Updated 4 years ago
• josh0xA / threadfire
  PoC Thread Execution Hijacking for Win32 Code Injection
  ☆177Updated 11 months ago
• ars3n11 / MineSweeper
  Windows user-land hooks manipulation tool.
  ☆144Updated 4 years ago
• reevesrs24 / EvasiveProcessHollowing
  Evasive Process Hollowing Techniques
  ☆141Updated 4 years ago
• WithSecureLabs / ModuleStomping
  https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/
  ☆121Updated 5 years ago
• praetorian-inc / vulcan
  a tool to make it easy and fast to test various forms of injection
  ☆172Updated 6 years ago
• sailay1996 / magnifier0day
  Windows 10 Privilege Escalation (magnifier.exe) via Dll Search Order Hijacking
  ☆142Updated 5 years ago
• JLospinoso / cpp-implant
  A simple implant showcasing modern C++
  ☆106Updated 4 years ago
• hasherezade / persistence_demos
  Demos of various (also non standard) persistence methods used by malware
  ☆222Updated 2 years ago
• hlldz / APC-PPID
  Adds a user-mode asynchronous procedure call (APC) object to the APC queue of the specified thread and spoof the Parent Process.
  ☆158Updated 6 years ago
• amitwaisel / Malproxy
  Proxy system calls over an RPC channel
  ☆98Updated 3 years ago
• LloydLabs / Windows-API-Hashing
  This is a simple example and explanation of obfuscating API resolution via hashing
  ☆235Updated 5 years ago
• am0nsec / vx
  Virus Exchange (VX) - Collection of malware or assembly code used for "offensive" purposed.
  ☆183Updated 3 years ago
• am0nsec / wspe
  Windows System Programming Experiments
  ☆220Updated 3 years ago
• EgeBalci / WSAAcceptBackdoor
  Winsock accept() Backdoor Implant.
  ☆115Updated 4 years ago
• hasherezade / masm_shc
  A helper utility for creating shellcodes. Cleans MASM file generated by MSVC, gives refactoring hints.
  ☆179Updated 2 months ago
• thesecretclub / ArbitraryDirectoryDeletion
  From directory deletion to SYSTEM shell
  ☆111Updated 5 years ago
• hasherezade / antianalysis_demos
  Set of antianalysis techniques found in malware
  ☆132Updated last year
• paranoidninja / Botnet-blogpost
  This repo basically contains the code that was mentioned in the blogposts that was written by me at:
  ☆96Updated 2 years ago
• Signal-Labs / NtdllUnpatcher
  Example code for EDR bypassing
  ☆150Updated 6 years ago
• panagioto / Mimir
  A C++ POC for process injection using NtCreateSectrion, NtMapViewOfSection and RtlCreateUserThread. Credit to @spotheplanet for his notes…
  ☆43Updated 4 years ago
• NtRaiseHardError / Kaiser
  Fileless persistence, attacks and anti-forensic capabilties.
  ☆91Updated 6 years ago
• manyfacedllama / amsi-tracer
  Leverage AMSI (Antimalware Scan Interface) technology to aid your analysis. This tool saves all buffers (scripts, .NET assemblies, etc) …
  ☆109Updated 4 years ago
• FSecureLABS / Ninjasploit
  A meterpreter extension for applying hooks to avoid windows defender memory scans
  ☆246Updated 4 years ago
• phra / x0rro
  A PE/ELF/MachO Crypter for x86 and x86_64 Based on Radare2
  ☆138Updated 2 years ago
• h0mbre / Windows-Exploits
  ☆91Updated 4 years ago