Alternatives and similar repositories for Get-InjectedThreadEx:

Users that are interested in Get-InjectedThreadEx are comparing it to the libraries listed below

• caueb / ThreadlessStompingKann
  Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.
  ☆61Updated last year
• thefLink / Hunt-Weird-ImageLoads
  Small tool to play with IOCs caused by Imageload events
  ☆42Updated last year
• LloydLabs / process-enumeration-stealth
  ☆82Updated 7 months ago
• xalicex / Unhook-Import-Address-Table
  Piece of code to detect and remove hooks in IAT
  ☆63Updated 2 years ago
• xalicex / Get-DLL-and-Function-Addresses
  GetModuleHandle (via PEB) and GetProcAddress (via EAT) like
  ☆32Updated 3 years ago
• 0xjbb / vehspoof
  Callstack spoofing using a VEH because VEH all the things.
  ☆21Updated last month
• mannyfred / SentinelBruh
  Dirty PoC on how to abuse S1's VEH for Vectored Syscalls and Local Execution
  ☆42Updated 9 months ago
• ScriptIdiot / SysmonQuiet
  RDLL for Cobalt Strike beacon to silence sysmon process
  ☆88Updated 2 years ago
• HulkOperator / CallStackSpoofer
  ☆29Updated 4 months ago
• xforcered / Being-A-Good-CLR-Host
  ☆103Updated 3 months ago
• cpu0x00 / EternelSuspention
  a simple poc showcasing the ability of an admin to suspend EDR's protected processes , making it useless
  ☆38Updated 9 months ago
• zimnyaa / insomnia
  a stage1 DLL loader with sleep obfuscation
  ☆35Updated 2 years ago
• RedTeamOperations / VEH-PoC
  ☆114Updated 2 years ago
• zero2504 / FrostLock-Injection
  FrostLock Injection is a freeze/thaw-based code injection technique that uses Windows Job Objects to temporarily freeze (suspend) a targe…
  ☆24Updated 2 weeks ago
• rkbennett / pybof
  Python module for running BOFs
  ☆70Updated last year
• 0prrr / Malwear-Sweet
  Malware?
  ☆69Updated 6 months ago
• jdu2600 / Etw-SyscallMonitor
  Monitors ETW for security relevant syscalls maintaining the set called by each unique process
  ☆76Updated last year
• codewhitesec / SysmonEnte
  ☆75Updated 2 years ago
• peiga / DumpThatLSASS
  Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk , plus functions and strings obfuscation
  ☆31Updated 2 years ago
• Fitretech-Security / dylight
  macOS dylib stager
  ☆32Updated 3 months ago
• CaptainNox / Hypnos
  A more reliable way of resolving syscall numbers in Windows
  ☆49Updated last year
• GetRektBoy724 / SyscallShuffler
  Your NTDLL vaccine from modern direct syscall methods.
  ☆35Updated 3 years ago
• passthehashbrowns / suspendedunhook
  ☆39Updated 4 years ago
• susMdT / effective-waffle
  yet another sleep encryption thing. also used the default github repo name for this one.
  ☆69Updated last year
• inb1ts / birdnet-poc
  Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.
  ☆39Updated last year
• mttaggart / quasar
  quASAR: ASAR manipulation made easy
  ☆37Updated 2 years ago
• joe-desimone / rep-research
  ☆72Updated 8 months ago
• passthehashbrowns / Being-A-Good-CLR-Host
  ☆55Updated 3 months ago
• MaorSabag / Paruns-Fart
  Just another ntdll unhooking using Parun's Fart technique
  ☆74Updated 2 years ago
• susMdT / ForsHops
  ForsHops
  ☆41Updated 3 weeks ago