A simple proof of concept for detecting use of Cobalt Strike's execute-assembly
☆59Apr 1, 2022Updated 4 years ago
Alternatives and similar repositories for Sniper
Users that are interested in Sniper are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Uses WMI Event Win32_ModuleLoadTrace to monitor module loading. Provides filters, and detailed data. Has an option to monitor for CLR Inj…☆42May 9, 2019Updated 7 years ago
- PoC to demonstrate how CLR ETW events can be tampered.☆189Mar 26, 2020Updated 6 years ago
- .Net Assembly to block ETW telemetry in current process☆78May 14, 2020Updated 6 years ago
- Cobalt Strike BOF to list Windows Pipes & return their Owners & DACL Permissions☆96Mar 8, 2023Updated 3 years ago
- D/Invoke port of UrbanBishop☆109Jul 19, 2020Updated 6 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- An injector that aims to be stealthy by using non suspicious API calls. Inspired by (https://github.com/FuzzySecurity/Sharp-Suite/tree/ma…☆24Jun 17, 2020Updated 6 years ago
- Load .net assemblies from memory while having them appear to be loaded from an on-disk location.☆172May 5, 2021Updated 5 years ago
- My CobaltStrike BOFS☆166Jul 23, 2022Updated 4 years ago
- A "no frills" 1 class-only, C# .NET command line parser with support for - and / args, switches only, and Name : Values☆34Jan 20, 2026Updated 9 months ago
- C# Implementation of Jared Atkinson's Get-InjectedThread.ps1☆56Jul 11, 2021Updated 5 years ago
- DLL Exports Extraction BOF with optional NTFS transactions.☆93Nov 5, 2021Updated 4 years ago
- Reflective DLL loading of your favorite Golang program☆173Jan 27, 2020Updated 6 years ago
- Using "svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc" as trigger☆58Oct 7, 2020Updated 6 years ago
- Loads .NET Assembly Via CLR Loader☆17Mar 6, 2019Updated 7 years ago
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- AMSI Bypass Via the Heap☆106Nov 20, 2020Updated 5 years ago
- A PowerShell script to prevent Sysmon from writing its events☆16Apr 23, 2020Updated 6 years ago
- Service Enumeration C# .NET Assembly☆57Sep 14, 2021Updated 5 years ago
- Using DInvoke to patch AMSI.dll in order to bypass AMSI detections triggered when loading .NET tradecraft via Assembly.Load().☆216Mar 5, 2020Updated 6 years ago
- Managed assembly shellcode generation☆282Mar 19, 2021Updated 5 years ago
- Suite of Shellcode Running Utilities☆112Jan 30, 2020Updated 6 years ago
- Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF)☆325Nov 9, 2021Updated 4 years ago
- ☆61Aug 30, 2021Updated 5 years ago
- Tool for interacting with outlook interop during red team engagements☆145Jun 29, 2021Updated 5 years ago
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- dem sharp donuts☆199Sep 11, 2022Updated 4 years ago
- MSBuild Without MSBuild.exe☆155Dec 21, 2020Updated 5 years ago
- Inject Encrypted Commands Into EMF Shapes for C2 In VBA / Office Malware☆40Jul 10, 2020Updated 6 years ago
- Create a minidump of the LSASS process from memory☆257Nov 2, 2022Updated 3 years ago
- Collection of Beacon Object Files (BOFs) for shells and lols☆124Sep 14, 2021Updated 5 years ago
- ☆21May 28, 2021Updated 5 years ago
- Project to check which Nt/Zw functions your local EDR is hooking☆200Mar 21, 2021Updated 5 years ago
- ☆100Aug 23, 2021Updated 5 years ago
- MSBuild without MSbuild.exe☆134Dec 21, 2020Updated 5 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Microsoft Applocker evasion tool☆39Nov 26, 2019Updated 6 years ago
- Ansible playbooks for instrumenting a Red Team environment with RedElk☆52Oct 6, 2020Updated 6 years ago
- C# port of LogServiceCrash☆45Oct 7, 2020Updated 6 years ago
- Run shellcode from resource☆255Dec 13, 2020Updated 5 years ago
- Also known by Microsoft as Knifecoat☆1,145Dec 22, 2022Updated 3 years ago
- ☆73Oct 24, 2021Updated 5 years ago
- C# application that allows you to quick run SSH commands against a host or list of hosts☆42Sep 21, 2020Updated 6 years ago