Alternatives and similar repositories for PhonyC2-MuddyWater-Research

Users that are interested in PhonyC2-MuddyWater-Research are comparing it to the libraries listed below

• wolfcod / beacondbg
  Beacon Debugger
  ☆55Updated last year
• farinap5 / bitmap4shell
  A (quite) simple steganography algorithm to hide shellcodes within bitmap image.
  ☆25Updated last year
• outflanknl / seccomp-notify-injection
  Linux Process Injection via Seccomp Notifier
  ☆81Updated last month
• preludeorg / ThreatIntelligenceConsumer
  Demonstrates consuming from a SecurityTrace ETW session by consuming from the Threat-Intelligence ETW provider without a driver or PPL pr…
  ☆53Updated last week
• fin3ss3g0d / HookFinder
  Simple PoC to locate hooked functions by EDR in ntdll.dll
  ☆46Updated 2 years ago
• listinvest / undonut
  Unpacker for donut shellcode
  ☆21Updated 5 years ago
• OtterHacker / CoffLoader
  ☆60Updated 3 years ago
• Ap3x / COFF-Loader
  A reimplementation of Cobalt Strike's Beacon Object File (BOF) Loader
  ☆64Updated 2 years ago
• Cobalt-Strike / obfuscator-llvm
  ☆57Updated 2 years ago
• benheise / TitanLdr
  Titan: A crappy Reflective Loader written in C and assembly for Cobalt Strike. Redirects DNS Beacon over DoH
  ☆69Updated 4 years ago
• emdnaia / OdinLdr
  Cobaltstrike UDRL with memory evasion
  ☆14Updated last year
• CyberSecurityUP / ProcessKiller-BYOVD
  BYOVD Technique Example using viragt64 driver
  ☆67Updated last year
• trustedsec / Windows-MS-LSAT-RPC-Example
  Windows RPC example calling stubs generated from MS-LSAT and MS-LSAD
  ☆28Updated 2 years ago
• Cracked5pider / Rhaast
  doesnt work and wont work on it anymore
  ☆10Updated last year
• boku7 / x64win-DynamicNoNull-WinExec-PopCalc-Shellcode
  64bit WIndows 10 shellcode dat pops dat calc - Dynamic & Null Free
  ☆65Updated 2 years ago
• RedTeamOperations / VEH-PoC
  ☆120Updated 3 years ago
• Crypt0s / Ekko_CFG_Bypass
  A PoC for adding NtContinue to CFG allowed list in order to make Ekko work in a CFG protected process
  ☆113Updated 3 years ago
• WKL-Sec / StackMask
  A PoC of Stack encryption prior to custom sleeping by leveraging CPU cycles.
  ☆66Updated 2 years ago
• dosxuz / PerunsFart
  This is my own implementation of the Perun's Fart technique by Sektor7
  ☆72Updated 3 years ago
• susMdT / effective-waffle
  yet another sleep encryption thing. also used the default github repo name for this one.
  ☆69Updated 2 years ago
• Meowmycks / etwunhook
  Simple ETW unhook PoC. Overwrites NtTraceEvent opcode to disable ETW at Nt-function level.
  ☆53Updated last year
• Octoberfest7 / Mutants_Sessions_Self-Deletion
  Writeup of Payload Techniques in C involving Mutants, Session 1 -> Session 0 migration, and Self-Deletion of payloads.
  ☆129Updated 3 years ago
• oldboy21 / SWAPPALA
  In-memory hiding technique
  ☆63Updated last year
• mdsecactivebreach / functionpeekaboo
  ☆60Updated 3 months ago
• JetP1ane / Artemis
  Artemis - C++ Hell's Gate Syscall Implementation
  ☆34Updated 2 years ago
• 0xedh / DEFCON33-KillChainReloaded
  Repository for the DEF CON 33 talk: Kill Chain Reloaded
  ☆77Updated 5 months ago
• xpn / ObjectOverloadingPOC
  ☆62Updated 3 years ago
• ph3n1x007 / EarlyBirdNTDLL
  ☆37Updated 2 years ago
• aaaddress1 / knownDlls_Poison
  ☆26Updated 4 years ago
• Allevon412 / PPL_Sandboxer
  ☆82Updated 3 years ago