florylsk / SignatureGate
Weaponized HellsGate/SigFlip
☆198Updated last year
Alternatives and similar repositories for SignatureGate:
Users that are interested in SignatureGate are comparing it to the libraries listed below
- Lateral Movement Using DCOM and DLL Hijacking☆283Updated last year
- .NET assembly loader with patchless AMSI and ETW bypass☆313Updated last year
- Source generator to add D/Invoke and indirect syscall methods to a C# project.☆173Updated 11 months ago
- CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking☆224Updated last year
- CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files (BOF) for Cobalt Strike to perform process inject…☆229Updated 2 years ago
- Extracting NetNTLM without touching lsass.exe☆233Updated last year
- Port of Cobalt Strike's Process Inject Kit☆165Updated 2 months ago
- An App Domain Manager Injection DLL PoC on steroids☆164Updated last year
- Execute shellcode files with rundll32☆190Updated last year
- Patch AMSI and ETW☆236Updated 9 months ago
- ☆160Updated last year
- Generate Shellcode Loaders & Injects☆153Updated last year
- A BOF to automate common persistence tasks for red teamers☆273Updated last year
- EDRSandblast-GodFault☆250Updated last year
- Hiding shellcode in plain sight within a large memory region. Inspired by technique used by Raspberry Robin's Roshtyak☆196Updated 2 years ago
- My implementation of the GIUDA project in C++☆167Updated last year
- Porting of BOF InlineExecute-Assembly to load .NET assembly in process but with patchless AMSI and ETW bypass using hardware breakpoint.☆208Updated last year
- reflectively load and execute PEs locally and remotely bypassing EDR hooks☆147Updated last year
- Bypass LSA protection using the BYODLL technique☆154Updated 5 months ago
- Generic PE loader for fast prototyping evasion techniques☆213Updated 7 months ago
- An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution☆172Updated 2 months ago
- Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime☆302Updated last year
- ☆220Updated 9 months ago
- Shaco is a linux agent for havoc☆156Updated last year
- A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.☆180Updated last year
- different ntdll unhooking techniques : unhooking ntdll from disk, from KnownDlls, from suspended process, from remote server (fileless)☆185Updated last year
- ☆151Updated last year
- ☆147Updated last year
- Patching AmsiOpenSession by forcing an error branching☆143Updated last year
- A Visual Studio template used to create Cobalt Strike BOFs☆289Updated 3 years ago