Alternatives and similar repositories for SignatureKid

Users that are interested in SignatureKid are comparing it to the libraries listed below

• V-i-x-x / kernel-callback-removal
  kernel callback removal (Bypassing EDR Detections)
  ☆175Updated 3 months ago
• 0xHossam / KernelCallbackTable-Injection-PoC
  Proof of Concept for manipulating the Kernel Callback Table in the Process Environment Block (PEB) to perform process injection and hijac…
  ☆226Updated 7 months ago
• hasherezade / waiting_thread_hijacking
  Waiting Thread Hijacking - injection by overwriting the return address of a waiting thread
  ☆221Updated 3 weeks ago
• rtecCyberSec / Packer_Development
  Slides & Code snippets for a workshop held @ x33fcon 2024
  ☆260Updated last year
• Maldev-Academy / LsassHijackingViaReg
  Injecting DLL into LSASS at boot
  ☆118Updated last month
• rad9800 / hwbp4mw
  ☆259Updated 2 years ago
• Maldev-Academy / Christmas
  ☆257Updated last year
• ColeHouston / Sunder
  Windows rootkit designed to work with BYOVD exploits
  ☆200Updated 5 months ago
• VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls
  The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls
  ☆195Updated last year
• klezVirus / DriverJack
  Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths
  ☆342Updated 10 months ago
• vxCrypt0r / Voidmaw
  A new technique that can be used to bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders imp…
  ☆314Updated 8 months ago
• Maldev-Academy / GhostlyHollowingViaTamperedSyscalls
  Implementing the ghostly hollowing PE injection technique using tampered syscalls.
  ☆156Updated 3 months ago
• Cracked5pider / earlycascade-injection
  early cascade injection PoC based on Outflanks blog post
  ☆219Updated 7 months ago
• oldboy21 / RflDllOb
  Reflective DLL Injection Made Bella
  ☆227Updated 5 months ago
• floesen / KExecDD
  Admin to Kernel code execution using the KSecDD driver
  ☆250Updated last year
• dobin / RedEdr
  Collect Windows telemetry for Maldev
  ☆356Updated 4 months ago
• vxCrypt0r / AMSI_VEH
  A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…
  ☆161Updated last year
• zer0condition / mhydeath
  Abusing mhyprotect to kill AVs / EDRs / XDRs / Protected Processes.
  ☆399Updated last year
• kleiton0x00 / Proxy-DLL-Loads
  A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.
  ☆346Updated 4 months ago
• 0xNinjaCyclone / EarlyCascade
  A PoC for Early Cascade process injection technique.
  ☆182Updated 4 months ago
• BlackSnufkin / BYOVD
  Some POCs for my BYOVD research and find some vulnerable drivers
  ☆248Updated last week
• V-i-x-x / AMSI-WRITE-RAID-BYPASS
  "AMSI WRITE RAID" Vulnerability that leads to an effective AMSI BYPASS
  ☆285Updated 2 months ago
• Offensive-Panda / RWX_MEMEORY_HUNT_AND_INJECTION_DV
  Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.
  ☆285Updated last year
• rad9800 / BootExecuteEDR
  ☆397Updated 6 months ago
• xalicex / Killers
  Exploitation of process killer drivers
  ☆201Updated last year
• MalwareTech / EDRception
  A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.
  ☆188Updated last year
• CyberSecurityUP / Offensive-Windows-Drivers-Development
  ☆129Updated 3 months ago
• ricardojoserf / NativeBypassCredGuard
  Bypass Credential Guard by patching WDigest.dll using only NTAPI functions
  ☆243Updated 2 months ago
• NtDallas / KrakenMask
  Sleep obfuscation
  ☆228Updated 6 months ago
• scrt / PowerChell
  A PowerShell console in C/C++ with all the security features disabled
  ☆252Updated last month