Alternatives and similar repositories for CreateFile_based_rootkit

Users that are interested in CreateFile_based_rootkit are comparing it to the libraries listed below

• uf0o / rootkit-arsenal-guacamole
  An attempt to restore and adapt to modern Win10 version the 'Rootkit Arsenal' original code samples
  ☆72Updated 3 years ago
• amitwaisel / Malproxy
  Proxy system calls over an RPC channel
  ☆99Updated 3 years ago
• Signal-Labs / NtdllUnpatcher
  Example code for EDR bypassing
  ☆150Updated 6 years ago
• reevesrs24 / EvasiveProcessHollowing
  Evasive Process Hollowing Techniques
  ☆141Updated 5 years ago
• sailay1996 / magnifier0day
  Windows 10 Privilege Escalation (magnifier.exe) via Dll Search Order Hijacking
  ☆142Updated 5 years ago
• WithSecureLabs / ModuleStomping
  https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/
  ☆121Updated 6 years ago
• t3rabyt3-zz / Gozi
  Gozi ISFB is a well-known and widely distributed banking trojan, and has been in the threat landscape for the past several years.
  ☆65Updated 7 years ago
• Maff1t / WindowsPermsPoC
  A simple PoC to demonstrate that is possible to write Non writable memory and execute Non executable memory on Windows
  ☆53Updated 4 years ago
• hasherezade / persistence_demos
  Demos of various (also non standard) persistence methods used by malware
  ☆221Updated 2 years ago
• ioncodes / CVE-2020-16938
  Bypassing NTFS permissions to read any files as unprivileged user.
  ☆190Updated 5 years ago
• am0nsec / wspe
  Windows System Programming Experiments
  ☆223Updated 3 years ago
• hlldz / APC-PPID
  Adds a user-mode asynchronous procedure call (APC) object to the APC queue of the specified thread and spoof the Parent Process.
  ☆158Updated 6 years ago
• JLospinoso / cpp-implant
  A simple implant showcasing modern C++
  ☆108Updated 4 years ago
• ars3n11 / MineSweeper
  Windows user-land hooks manipulation tool.
  ☆145Updated 4 years ago
• med0x2e / NoAmci
  Using DInvoke to patch AMSI.dll in order to bypass AMSI detections triggered when loading .NET tradecraft via Assembly.Load().
  ☆217Updated 5 years ago
• NtRaiseHardError / NINA
  NINA: No Injection, No Allocation x64 Process Injection Technique
  ☆227Updated 5 years ago
• manyfacedllama / amsi-tracer
  Leverage AMSI (Antimalware Scan Interface) technology to aid your analysis. This tool saves all buffers (scripts, .NET assemblies, etc) …
  ☆112Updated 4 years ago
• frkngksl / Celeborn
  Userland API Unhooker Project
  ☆109Updated 4 years ago
• FSecureLABS / Ninjasploit
  A meterpreter extension for applying hooks to avoid windows defender memory scans
  ☆247Updated 5 years ago
• praetorian-inc / vulcan
  a tool to make it easy and fast to test various forms of injection
  ☆173Updated 6 years ago
• EgeBalci / WSAAcceptBackdoor
  Winsock accept() Backdoor Implant.
  ☆118Updated 4 years ago
• CptGibbon / Windows-Process-Injection
  Some simple process injection techniques targeting the Windows platform
  ☆31Updated 5 years ago
• mdsecactivebreach / firewalker
  ☆153Updated 5 years ago
• leoloobeek / COMProxy
  PoC for proxying COM objects when hijacking
  ☆212Updated 6 years ago
• paranoidninja / Botnet-blogpost
  This repo basically contains the code that was mentioned in the blogposts that was written by me at:
  ☆96Updated 2 years ago
• panagioto / Mimir
  A C++ POC for process injection using NtCreateSectrion, NtMapViewOfSection and RtlCreateUserThread. Credit to @spotheplanet for his notes…
  ☆43Updated 4 years ago
• forrest-orr / DoubleStar
  A personalized/enhanced re-creation of the Darkhotel "Double Star" APT exploit chain with a focus on Windows 8.1 and mixed with some of m…
  ☆147Updated 3 years ago
• LloydLabs / dearg-thread-ipc-stealth
  A novel technique to communicate between threads using the standard ETHREAD structure
  ☆114Updated 4 years ago
• bats3c / DefensiveInjector
  Shellcode injector using direct syscalls
  ☆123Updated 5 years ago
• 0xpat / COFFInjector
  PoC MSVC COFF Object file loader/injector.
  ☆180Updated 4 years ago