f1zm0 / acheron
indirect syscalls for AV/EDR evasion in Go assembly
☆326Updated last year
Alternatives and similar repositories for acheron:
Users that are interested in acheron are comparing it to the libraries listed below
- Go shellcode loader that combines multiple evasion techniques☆363Updated last year
- A beacon object file implementation of PoolParty Process Injection Technique.☆374Updated last year
- A tool employs direct registry manipulation to create scheduled tasks without triggering the usual event logs.☆534Updated 2 months ago
- Terminate AV/EDR Processes using kernel driver☆340Updated last year
- A Visual Studio template used to create Cobalt Strike BOFs☆297Updated 3 years ago
- Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime☆302Updated last year
- Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.☆304Updated 11 months ago
- shellcode loader for your evasion needs☆317Updated 4 months ago
- Execute shellcode from a remote-hosted bin file using Winhttp.☆232Updated last year
- A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!☆323Updated 8 months ago
- COM Hijacking VOODOO☆268Updated 2 weeks ago
- A CobaltStrike toolkit to write files produced by Beacon to memory instead of disk☆451Updated 8 months ago
- A BOF that runs unmanaged PEs inline☆582Updated 5 months ago
- ☆243Updated 2 years ago
- Credential Guard Bypass Via Patching Wdigest Memory☆321Updated 2 years ago
- laZzzy is a shellcode loader, developed using different open-source libraries, that demonstrates different execution techniques.☆469Updated 2 years ago
- Encrypted shellcode Injection to avoid Kernel triggered memory scans☆365Updated last year
- Execute shellcode files with rundll32☆193Updated last year
- Kill AV/EDR leveraging BYOVD attack☆344Updated last year
- A C2 framework for initial access in Go☆177Updated 2 years ago
- A Stealthy Lsass Dumper - can abuse ProcExp152.sys driver to dump PPL Lsass, no dbghelp.lib calls.☆320Updated 2 years ago
- Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry☆395Updated 7 months ago
- A list of python tools to help create an OPSEC-safe Cobalt Strike profile.☆410Updated last year
- A Go implementation of Cobalt Strike style BOF/COFF loaders.☆204Updated last month
- Bypassing UAC with SSPI Datagram Contexts☆430Updated last year
- Reduce Entropy And Obfuscate Youre Payload With Serialized Linked Lists☆423Updated last year
- Creating a repository with all public Beacon Object Files (BoFs)☆464Updated last year
- Collection of Beacon Object Files (BOF) for Cobalt Strike☆572Updated 8 months ago
- Generate an obfuscated DLL that will disable AMSI & ETW☆319Updated 8 months ago
- BOF implementation of @_EthicalChaos_'s ThreadlessInject project. A novel process injection technique with no thread creation, released a…☆372Updated last year