Alternatives and similar repositories for concealed_position:

Users that are interested in concealed_position are comparing it to the libraries listed below

• xforcered / CredBandit
  Proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that b…
  ☆240Updated 3 years ago
• bats3c / EvtMute
  Apply a filter to the events being reported by windows event logging
  ☆261Updated 3 years ago
• boku7 / HOLLOW
  EarlyBird process hollowing technique (BOF) - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and e…
  ☆278Updated 2 years ago
• deepinstinct / LsassSilentProcessExit
  Command line interface to dump LSASS memory to disk via SilentProcessExit
  ☆443Updated 4 years ago
• outflanknl / InlineWhispers
  Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF)
  ☆314Updated 3 years ago
• boku7 / Ninja_UUID_Runner
  Module Stomping, No New Thread, HellsGate syscaller, UUID Shellcode Runner for x64 Windows 10!
  ☆439Updated 2 years ago
• xforcered / WFH
  ☆189Updated 2 years ago
• connormcgarr / LittleCorporal
  LittleCorporal: A C# Automated Maldoc Generator
  ☆228Updated 3 years ago
• antonioCoco / MalSeclogon
  A little tool to play with the Seclogon service
  ☆310Updated 2 years ago
• mdsecactivebreach / Farmer
  ☆365Updated 3 years ago
• jfmaes / Invoke-DLLClone
  Koppeling x Metatwin x LazySign
  ☆209Updated 3 years ago
• lab52io / LeakedHandlesFinder
  Leaked Windows processes handles identification tool
  ☆286Updated 3 years ago
• thefLink / DeepSleep
  A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC
  ☆364Updated 2 years ago
• RedSection / OffensivePH
  OffensivePH - use old Process Hacker driver to bypass several user-mode access controls
  ☆330Updated 3 years ago
• xforcered / InlineExecute-Assembly
  InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assem…
  ☆189Updated 3 years ago
• trustedsec / COFFLoader
  ☆508Updated 5 months ago
• ajpc500 / BOFs
  Collection of Beacon Object Files
  ☆579Updated 2 years ago
• itm4n / PPLmedic
  Dump the memory of any PPL with a Userland exploit chain
  ☆333Updated 2 years ago
• binderlabs / DirCreate2System
  Weaponizing to get NT SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting
  ☆357Updated 2 years ago
• subat0mik / whoamsi
  An effort to track security vendors' use of Microsoft's Antimalware Scan Interface
  ☆243Updated 3 years ago
• last-byte / RIPPL
  RIPPL is a tool that abuses a usermode only exploit to manipulate PPL processes on Windows
  ☆7Updated 3 years ago
• boku7 / winx64-InjectAllProcessesMeterpreter-Shellcode
  64bit Windows 10 shellcode that injects all processes with Meterpreter reverse shells.
  ☆128Updated 2 years ago
• deepinstinct / Lsass-Shtinkering
  ☆376Updated 2 years ago
• CCob / SylantStrike
  Simple EDR implementation to demonstrate bypass
  ☆171Updated 4 years ago
• rsmudge / unhook-bof
  Remove API hooks from a Beacon process.
  ☆268Updated 3 years ago
• jfmaes / SharpZipRunner
  Executes position independent shellcode from an encrypted zip
  ☆302Updated 4 years ago
• paranoidninja / PIC-Get-Privileges
  Building and Executing Position Independent Shellcode from Object Files in Memory
  ☆157Updated 4 years ago
• optiv / Dent
  A framework for creating COM-based bypasses utilizing vulnerabilities in Microsoft's WDAPT sensors.
  ☆297Updated last year
• boku7 / spawn
  Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks b…
  ☆453Updated 2 years ago
• med0x2e / NoAmci
  Using DInvoke to patch AMSI.dll in order to bypass AMSI detections triggered when loading .NET tradecraft via Assembly.Load().
  ☆215Updated 5 years ago