Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.
☆41Jul 9, 2023Updated 3 years ago
Alternatives and similar repositories for birdnet-poc
Users that are interested in birdnet-poc are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆142Jun 21, 2023Updated 3 years ago
- miscellaneous codes☆38Sep 24, 2023Updated 3 years ago
- ☆10Jul 1, 2023Updated 3 years ago
- In-memory hiding technique☆66Jan 5, 2025Updated last year
- A python polymorphic engine for C programs☆11Dec 8, 2023Updated 2 years ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Use hardware breakpoints to spoof the call stack for both syscalls and API calls☆205Jun 6, 2024Updated 2 years ago
- An In-memory Embedding of CPython☆31May 24, 2021Updated 5 years ago
- Shellcode loader☆104Nov 24, 2024Updated last year
- Port of Cobalt Strike's Process Inject Kit☆195Dec 1, 2024Updated last year
- EDR/AV Simulation for Malware Development☆12Oct 21, 2023Updated 3 years ago
- Apply a divide and conquer approach to bypass EDRs☆289Oct 19, 2023Updated 3 years ago
- ☆110Aug 21, 2024Updated 2 years ago
- Simple reverse ICMP shell☆15Apr 30, 2024Updated 2 years ago
- An example of how a driver can register a handle creation callback.☆16Jun 12, 2023Updated 3 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆411Jan 11, 2026Updated 9 months ago
- Abuse leaked token handles.☆135Dec 14, 2023Updated 2 years ago
- ☆123Dec 23, 2022Updated 3 years ago
- .NET assembly loader with patchless AMSI and ETW bypass☆393Apr 19, 2023Updated 3 years ago
- Example of using Sleep to create better named pipes.☆40Jul 25, 2023Updated 3 years ago
- OSED Practice binary☆28Nov 23, 2023Updated 2 years ago
- Terminate AV/EDR Processes using kernel driver☆354Jun 12, 2023Updated 3 years ago
- Bypassing Amsi using LdrLoadDll☆48Jan 8, 2025Updated last year
- Cobalt Strike UDRL for memory scanner evasion.☆50Dec 4, 2023Updated 2 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- ☆163Dec 30, 2022Updated 3 years ago
- Lateral Movement via the .NET Profiler☆99Nov 21, 2024Updated last year
- The code is a pingback to the Dark Vortex blog: https://0xdarkvortex.dev/hiding-memory-allocations-from-mdatp-etwti-stack-tracing/☆220Jan 29, 2023Updated 3 years ago
- BOF that finds all the Nt* system call stubs within NTDLL and overwrites with clean syscall stubs (user land hook evasion)☆219Feb 6, 2025Updated last year
- Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low…☆147May 6, 2023Updated 3 years ago
- ☆43Feb 18, 2025Updated last year
- An (WIP) EDR Evasion tool for x64 Windows & Linux binaries that utilizes Nanomites, written in Rust.☆35May 8, 2026Updated 5 months ago
- An all-in-one Cobalt Strike BOF to patch, check and revert AMSI and ETW for x64 process. Both syscalls and dynamic resolve versions are a…☆146Oct 1, 2022Updated 4 years ago
- A C# port from Invoke-GhostTask☆120Jan 5, 2024Updated 2 years ago
- Open source password manager - Proton Pass • AdSecurely store, share, and autofill your credentials with Proton Pass, the end-to-end encrypted password manager trusted by millions.
- Self Delete DLL☆22Feb 15, 2024Updated 2 years ago
- Basic implementation of Cobalt Strikes - User Defined Reflective Loader feature☆100Feb 28, 2023Updated 3 years ago
- ☆211Nov 28, 2023Updated 2 years ago
- powershell script i wrote that can suspend an arbitrary process (with limits)☆22Mar 26, 2023Updated 3 years ago
- Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …☆311Jul 31, 2024Updated 2 years ago
- I will be uploading all the codes which I created with the help either opensource projects or blogs. This is a step by step EDR learning …☆292Aug 1, 2025Updated last year
- Zero EAT touch way to retrieve function addresses (GetProcAddress on steroids)☆147Mar 16, 2024Updated 2 years ago