frkngksl / UnlinkDLL
DLL Unlinking from InLoadOrderModuleList, InMemoryOrderModuleList, InInitializationOrderModuleList, and LdrpHashTable
☆57Updated last year
Alternatives and similar repositories for UnlinkDLL:
Users that are interested in UnlinkDLL are comparing it to the libraries listed below
- ☆59Updated last year
- Section-based payload obfuscation technique for x64☆59Updated 7 months ago
- A pure C version of SymProcAddress☆25Updated last year
- ☆48Updated last year
- This is the combination of multiple evasion techniques to evade defenses. (Dirty Vanity)☆47Updated 10 months ago
- ☆53Updated 5 months ago
- API Hammering with C++20☆45Updated 2 years ago
- EvtPsst☆53Updated last year
- a simple poc showcasing the ability of an admin to suspend EDR's protected processes , making it useless☆38Updated 8 months ago
- Adaptive DLL hijacking / dynamic export forwarding - EAT preserve☆76Updated 7 months ago
- 「⚙️」Detect which native Windows API's (NtAPI) are being hooked☆38Updated 3 months ago
- NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg☆46Updated last year
- miscellaneous codes☆35Updated last year
- "D3MPSEC" is a memory dumping tool designed to extract memory dump from Lsass process using various techniques, including direct system c…☆24Updated 6 months ago
- ☆25Updated 3 months ago
- An Aggressor Script that utilizes NtCreateUserProcess to run binaries☆25Updated last month
- A more reliable way of resolving syscall numbers in Windows☆48Updated last year
- ☆29Updated 3 months ago
- ☆85Updated 7 months ago
- BOF for C2 framework☆40Updated 4 months ago
- Indirect Syscall implementation to bypass userland NTAPIs hooking.☆73Updated 7 months ago
- Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.☆59Updated last year
- Windows AppLocker Driver (appid.sys) LPE☆53Updated 7 months ago
- FrostLock Injection is a freeze/thaw-based code injection technique that uses Windows Job Objects to temporarily freeze (suspend) a targe…☆14Updated 2 months ago
- Splitting and executing shellcode across multiple pages☆100Updated last year
- RunPE adapted for x64 and written in C, does not use RWX☆24Updated 10 months ago
- Red Team Operation's Defense Evasion Technique.☆52Updated 9 months ago
- Your NTDLL vaccine from modern direct syscall methods.☆35Updated 2 years ago
- Small tool to play with IOCs caused by Imageload events☆42Updated last year
- Windows 10 DLL Injector via Driver utilizing VAD and hiding the loaded driver☆50Updated last year