Simple PoC to locate hooked functions by EDR in ntdll.dll
☆45Jul 16, 2023Updated 3 years ago
Alternatives and similar repositories for HookFinder
Users that are interested in HookFinder are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- remote process injections using pool party techniques☆72Jun 29, 2025Updated last year
- BOF to decrypt Signal Desktop chat logs☆69Feb 20, 2025Updated last year
- SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application.☆76May 1, 2024Updated 2 years ago
- ForsHops☆60Mar 25, 2025Updated last year
- A Cobalt Strike payload generator and lateral movement aggressor script which places Beacon shellcode into a custom shellcode loader☆44Sep 25, 2024Updated 2 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- BadExclusions is a tool to identify folder custom or undocumented exclusions on AV/EDR☆21Feb 8, 2024Updated 2 years ago
- SharpDPAPI ported to Cobalt Strike BOFs — 19 self-contained BOFs for DPAPI credential triage☆18Feb 24, 2026Updated 8 months ago
- A synergized Visual Studio and Rust development environment☆18Jan 25, 2025Updated last year
- Beacon Object File (BOF) for identifying dependent child services of a given parent.☆19Jun 20, 2025Updated last year
- DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly☆67Mar 19, 2024Updated 2 years ago
- Dump protected process memory by using BYOVD to tamper with handle objects in the kernel.☆48Aug 5, 2025Updated last year
- BOF with Synthetic Stackframe☆274Oct 30, 2025Updated last year
- PowerShell Implementation of ADFSDump to assist with GoldenSAML☆45Jul 30, 2026Updated 3 months ago
- Beacon Object File (BOF) to obtain Entra tokens via authcode flow.☆143Jan 17, 2026Updated 9 months ago
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- This POC provides the possibilty to execute x86 shellcode in form of a .bin file based on x86 inline assembly☆20Apr 17, 2023Updated 3 years ago
- early cascade injection PoC based on Outflanks blog post, in rust☆64Nov 8, 2024Updated last year
- yet another sleep encryption thing. also used the default github repo name for this one.☆67May 11, 2023Updated 3 years ago
- ADSIsearch is a Beacon Object File (BOF) to query Active Directory using ADDS, ADSI, and Network Management WinAPIs.☆10Feb 23, 2025Updated last year
- A Beacon Object File suite for Microsoft SQL Server that speaks TDS 7.4 on the wire itself☆101Apr 9, 2026Updated 6 months ago
- Weaponizing DCOM for NTLM Authentication Coercions☆217Nov 4, 2025Updated 11 months ago
- Parser and reconciliation tooling for large Active Directory environments.☆34Feb 18, 2025Updated last year
- Mirage is a PoC memory evasion technique that relies on a vulnerable VBS enclave to hide shellcode within VTL1.☆115Feb 25, 2025Updated last year
- Cobalt Strike Beacon Object File (BOF) that obtain SYSTEM privilege with SeImpersonate privilege by passing a malicious IUnknwon object t…☆102Mar 20, 2023Updated 3 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- A remote process injection using process snapshotting based on https://gitlab.com/ORCA000/snaploader , in rust. It creates a sacrificial …☆49Jan 25, 2025Updated last year
- HookDetection☆43Sep 3, 2021Updated 5 years ago
- Implant drop-in for EDR testing☆145Nov 15, 2023Updated 2 years ago
- Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle…☆15Jan 7, 2023Updated 3 years ago
- Your Windows syscall hooking factory - feat Canterlot's Gate - All accessible over MCP☆136Oct 25, 2026Updated last week
- EDR/AV Simulation for Malware Development☆12Oct 21, 2023Updated 3 years ago
- A C# implementation that disables Windows Firewall bypassing UAC☆17Oct 23, 2024Updated 2 years ago
- A set of programs for analyzing common vulnerabilities in COM☆266Sep 8, 2024Updated 2 years ago
- Use hardware breakpoints to spoof the call stack for both syscalls and API calls☆205Jun 6, 2024Updated 2 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- A hacky way of getting cross-arch/platform support in Cobalt Strike☆38Aug 31, 2025Updated last year
- adws enumeration bof☆176Sep 1, 2026Updated 2 months ago
- A simple BOF that disables some logging with NtSetInformationProcess☆14Oct 13, 2023Updated 3 years ago
- An (WIP) EDR Evasion tool for x64 Windows & Linux binaries that utilizes Nanomites, written in Rust.☆35May 8, 2026Updated 5 months ago
- Shellcode loader that executes embedded Lua from Rust.☆125Dec 16, 2024Updated last year
- A COFF Loader written in Rust☆146Oct 11, 2026Updated 3 weeks ago
- Drop any Windows DPAPI artifact and it identifies the format and the exact master key it needs, then decrypts once you supply the key. Of…☆30Sep 23, 2026Updated last month