killvxk / awesome-C2
C2
☆83Updated this week
Alternatives and similar repositories for awesome-C2:
Users that are interested in awesome-C2 are comparing it to the libraries listed below
- ☆239Updated last year
- Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …☆233Updated 5 months ago
- A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…☆169Updated last year
- A PoC implementation for dynamically masking call stacks with timers.☆260Updated last year
- A Beacon Object File (BOF) template for Visual Studio☆157Updated 5 months ago
- ☆95Updated last year
- CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files (BOF) for Cobalt Strike to perform process inject…☆231Updated 2 years ago
- Load static-compiled PE from remote server.☆59Updated 3 years ago
- Execute a payload at each right click on a file/folder in the explorer menu for persistence☆170Updated last year
- Generic PE loader for fast prototyping evasion techniques☆189Updated 6 months ago
- Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution☆168Updated 10 months ago
- Windows LPE☆115Updated 7 months ago
- Shellcode obfuscation tool to avoid AV/EDR.☆110Updated last year
- Huffman Coding in Shellcode Obfuscation & Dynamic Indirect Syscalls Loader.☆88Updated 10 months ago
- Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique☆61Updated 2 years ago
- Reproducing Spyboy technique, which involves terminating all EDR/XDR/AVs processes by abusing the zam64.sys driver☆253Updated 6 months ago
- Shellcode Loader Implementing Indirect Dynamic Syscall , API Hashing, Fileless Shellcode retrieving using Winsock2☆288Updated last year
- Client/server code that impersonates TLS 1.3 to disguise C2 activity.☆61Updated 2 years ago
- Some POCs for my BYOVD research and find some vulnerable drivers☆154Updated 4 months ago
- Reflective DLL Injection Made Bella☆213Updated last week
- Amaterasu terminates, or inhibits, protected processes such as application control and AV/EDR solutions by leveraging the Sysinternals Pr…☆71Updated 10 months ago
- Proof of concept code for thread pool based process injection in Windows.☆111Updated last month
- TeamServer and Client of Exploration Command and Control Framework☆82Updated this week
- Weaponized HellsGate/SigFlip☆198Updated last year
- CaveCarver - PE backdooring tool which utilizes and automates code cave technique☆217Updated last year
- Lockbit3.0 Microsoft Defender MpClient.dll DLL Hijacking PoC☆172Updated 2 years ago
- Cobalt Strike Beacon Object File for bypassing UAC via the CMSTPLUA COM interface.☆150Updated 2 years ago
- bring your own vulnerable driver☆90Updated last year