Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.
☆42Jul 9, 2023Updated 3 years ago
Alternatives and similar repositories for birdnet-poc
Users that are interested in birdnet-poc are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A library to parse, modify, and implement Malleable C2 profiles☆27Feb 9, 2019Updated 7 years ago
- ☆10Jul 1, 2023Updated 3 years ago
- Simple reverse ICMP shell☆14Apr 30, 2024Updated 2 years ago
- An In-memory Embedding of CPython☆31May 24, 2021Updated 5 years ago
- Use hardware breakpoints to spoof the call stack for both syscalls and API calls☆206Jun 6, 2024Updated 2 years ago
- Deploy open-source AI quickly and easily - Special Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- A python polymorphic engine for C programs☆11Dec 8, 2023Updated 2 years ago
- EDR/AV Simulation for Malware Development☆13Oct 21, 2023Updated 2 years ago
- miscellaneous codes☆38Sep 24, 2023Updated 2 years ago
- Bypassing Amsi using LdrLoadDll☆48Jan 8, 2025Updated last year
- Shellcode loader☆104Nov 24, 2024Updated last year
- In-memory hiding technique☆65Jan 5, 2025Updated last year
- Port of Cobalt Strike's Process Inject Kit☆194Dec 1, 2024Updated last year
- An all-in-one Cobalt Strike BOF to patch, check and revert AMSI and ETW for x64 process. Both syscalls and dynamic resolve versions are a…☆145Oct 1, 2022Updated 3 years ago
- An example of how a driver can register a handle creation callback.☆16Jun 12, 2023Updated 3 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- powershell script i wrote that can suspend an arbitrary process (with limits)☆22Mar 26, 2023Updated 3 years ago
- .NET assembly loader with patchless AMSI and ETW bypass☆386Apr 19, 2023Updated 3 years ago
- Self Delete DLL☆22Feb 15, 2024Updated 2 years ago
- ☆121Dec 23, 2022Updated 3 years ago
- Apply a divide and conquer approach to bypass EDRs☆287Oct 19, 2023Updated 2 years ago
- Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low…☆147May 6, 2023Updated 3 years ago
- Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle…☆16Jan 7, 2023Updated 3 years ago
- Cobalt Strike UDRL for memory scanner evasion.☆52Dec 4, 2023Updated 2 years ago
- Porting of NPPSPY by Grzegorz Tworek to 'man in the middle' the user logon process, and store the user's name and password in an unassumi…☆20Apr 24, 2023Updated 3 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- ☆60Dec 15, 2023Updated 2 years ago
- ☆164Dec 30, 2022Updated 3 years ago
- Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …☆102Mar 27, 2025Updated last year
- Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.☆292May 27, 2024Updated 2 years ago
- This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for loc…☆55May 8, 2023Updated 3 years ago
- Research of modifying exported function names at runtime (C/C++, Windows)☆18May 28, 2024Updated 2 years ago
- BOF that finds all the Nt* system call stubs within NTDLL and overwrites with clean syscall stubs (user land hook evasion)☆219Feb 6, 2025Updated last year
- Zero EAT touch way to retrieve function addresses (GetProcAddress on steroids)☆147Mar 16, 2024Updated 2 years ago
- Your NTDLL vaccine from modern direct syscall methods.☆36Apr 5, 2022Updated 4 years ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- some AV / EDR / analysis studies☆10May 21, 2023Updated 3 years ago
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆410Jan 11, 2026Updated 6 months ago
- ☆110Aug 21, 2024Updated last year
- An EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer☆555Feb 13, 2024Updated 2 years ago
- Abuse leaked token handles.☆136Dec 14, 2023Updated 2 years ago
- The code is a pingback to the Dark Vortex blog: https://0xdarkvortex.dev/hiding-memory-allocations-from-mdatp-etwti-stack-tracing/☆215Jan 29, 2023Updated 3 years ago
- PowerShell Implementation of ADFSDump to assist with GoldenSAML☆44Dec 7, 2025Updated 7 months ago