jfmaes / AmsiHooker
Hookers are cooler than patches.
☆168Updated 2 years ago
Alternatives and similar repositories for AmsiHooker:
Users that are interested in AmsiHooker are comparing it to the libraries listed below
- InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assem…☆184Updated 3 years ago
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆111Updated last year
- Patch AMSI and ETW☆234Updated 8 months ago
- Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2☆179Updated 2 years ago
- A tool for converting SysWhispers3 syscalls for use with Nim projects☆141Updated 2 years ago
- POC for frustrating/defeating Malware Analysts☆155Updated 2 years ago
- Dynamically invoke arbitrary unmanaged code from managed code without P/Invoke.☆149Updated 11 months ago
- CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files (BOF) for Cobalt Strike to perform process inject…☆230Updated 2 years ago
- Experiment on reproducing Obfuscate & Sleep☆140Updated 3 years ago
- C# version of MDSec's ParallelSyscalls☆139Updated 3 years ago
- An example of using Syscalls in C# to get a meterpreter shell.☆108Updated 3 years ago
- tgtdelegation is a Beacon Object File (BOF) to obtain a usable TGT via the "TGT delegation trick"☆166Updated 3 years ago
- Reuse open handles to dynamically dump LSASS.☆236Updated 9 months ago
- ☆184Updated this week
- Infect Shared Files In Memory for Lateral Movement☆193Updated 2 years ago
- Source generator to add D/Invoke and indirect syscall methods to a C# project.☆173Updated 10 months ago
- A basic meterpreter protocol stager using the libpeconv library by hasherezade for reflective loading☆83Updated 2 years ago
- C# POC to extract NetNTLMv1/v2 hashes from ETW provider☆252Updated last year
- C# porting of SysWhispers2. It uses SharpASM to find the code caves for executing the system call stub.☆104Updated last year
- A Stealthy Lsass Dumper - can abuse ProcExp152.sys driver to dump PPL Lsass, no dbghelp.lib calls.☆316Updated last year
- A fake AMSI Provider which can be used for persistence.☆141Updated 3 years ago
- Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post☆88Updated 2 years ago
- Find .net assemblies locally☆103Updated 2 years ago
- You shall pass☆252Updated 2 years ago
- A new AMSI Bypass technique using .NET ALI Call Hooking.☆185Updated 2 years ago