danafaye / WindowsAPIAbuseAtlasLinks
A living guide to lesser-known and evasive Windows API abuses used in malware, with practical reverse engineering notes, YARA detections, and behavioral indicators.
☆79Updated 3 weeks ago
Alternatives and similar repositories for WindowsAPIAbuseAtlas
Users that are interested in WindowsAPIAbuseAtlas are comparing it to the libraries listed below
Sorting:
- ☆180Updated 6 months ago
- ☆244Updated 5 months ago
- Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in thi…☆199Updated 2 months ago
- Slides & Code snippets for a workshop held @ x33fcon 2024☆272Updated last year
- A small program written in C that is designed to load 32/64-bit shellcode and allow for execution or debugging. Can also output PE files …☆167Updated last year
- ☆265Updated 2 years ago
- kernel callback removal (Bypassing EDR Detections)☆201Updated last week
- Python tool to check rootkits in Windows kernel☆203Updated 3 months ago
- ☆71Updated 9 months ago
- ☆158Updated 5 months ago
- Admin to Kernel code execution using the KSecDD driver☆260Updated last year
- ☆154Updated 6 months ago
- lib-nosa is a minimalist C library designed to facilitate socket connections through AFD driver IOCTL operations on Windows.☆117Updated last year
- Collect Windows telemetry for Maldev☆434Updated 2 weeks ago
- Evade EDR's the simple way, by not touching any of the API's they hook.☆162Updated 9 months ago
- Tools for analyzing EDR agents☆269Updated last year
- ☆114Updated last week
- A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.☆318Updated 2 years ago
- IoctlHunter is a command-line tool designed to simplify the analysis of IOCTL calls made by userland software targeting Windows drivers.☆104Updated last year
- ☆373Updated 5 months ago
- MIPS VM to execute payloads without allocating executable memory. Based on a PlayStation 1 (PSX) Emulator.☆121Updated 11 months ago
- early cascade injection PoC based on Outflanks blog post☆232Updated last year
- ☆105Updated last year
- Direct access to NTFS volumes☆283Updated 2 months ago
- ☆192Updated last year
- "Service-less" driver loading☆162Updated 11 months ago
- ☆164Updated 8 months ago
- ☆255Updated last year
- Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…☆273Updated last year
- Injecting DLL into LSASS at boot☆145Updated 6 months ago