Alternatives and similar repositories for WinPIT:

Users that are interested in WinPIT are comparing it to the libraries listed below

• ashr / netrefject
  Inject .Net payloads into other .Net assemblies on disk
  ☆61Updated 5 years ago
• two06 / AMSI_Handler
  Automate AV evasion by calling AMSI
  ☆87Updated last year
• vletoux / OxidBindings
  Extract all IP of a computer using DCOM without authentication (aka detect network used for administration)
  ☆26Updated 5 years ago
• apt69 / RibeyeSpecial
  medium-rare
  ☆28Updated 5 years ago
• perturbed-platypus / UEFIWriteCSharp
  ☆41Updated 5 years ago
• XaFF-XaFF / AMSI-Bypass
  Rasta's mouse AMSI patch but with function that makes it undetectable.
  ☆13Updated 3 years ago
• TheWover / ModuleMonitor
  Uses WMI Event Win32_ModuleLoadTrace to monitor module loading. Provides filters, and detailed data. Has an option to monitor for CLR Inj…
  ☆41Updated 5 years ago
• slyd0g / SK8PARK
  Python 3 server used to control SK8RAT implant
  ☆36Updated 4 years ago
• jackullrich / universal-syscall-64
  Resolve syscall numbers at runtime for all Windows versions.
  ☆61Updated 4 months ago
• djhohnstein / CSharpCreateThreadExample
  C# code to run PIC using CreateThread
  ☆17Updated 5 years ago
• padovah4ck / RedSharp
  Penetration Test / Read Team - C# tools repository
  ☆57Updated 3 years ago
• rasta-mouse / AsyncNamedPipes
  Send and receive messages over Named Pipes asynchronously.
  ☆39Updated 3 years ago
• sevagas / weaponize_process_injection_windows_SIGSEGv2_2019
  Files related to my presentation at SigSegV2 conference in 2019. You can find related papers on my blog
  ☆13Updated 5 years ago
• Soledge / BlockEtw
  .Net Assembly to block ETW telemetry in current process
  ☆78Updated 4 years ago
• fullmetalcache / CsharpMMNiceness
  Files for generating a C# source file that allows for memory-mapping "niceness" and then executing said "niceness"
  ☆31Updated 6 years ago
• fozavci / ransoblin
  Ransoblin (Ransomware Bokoblin)
  ☆18Updated 4 years ago
• dsnezhkov / RunDllMShim
  Run Managed Assemblies with RunDll
  ☆17Updated 6 years ago
• py7hagoras / OfficeMacro64
  This is a 64 bit VBA implementation of Christophe Tafani-Dereeper's original VBA code described in his blog @ https://blog.christophetd.f…
  ☆20Updated 5 years ago
• SolomonSklash / UnhookingPOC
  A small commented POC for removing API hooks placed by AV/EDR.
  ☆34Updated 4 years ago
• tomcarver16 / SimpleInjector
  A simple injector that uses LoadLibraryA
  ☆17Updated 4 years ago
• DamonMohammadbagher / NativePayload_Tinjection
  Remote Thread Injection by C# + Delegate Techniques
  ☆12Updated last year
• rvrsh3ll / UACSilentCleanup
  ☆14Updated 5 years ago
• AltF5 / CSharp-CmdLineHelper-Parser
  A "no frills" 1 class-only, C# .NET command line parser with support for - and / args, switches only, and Name : Values
  ☆33Updated last year
• checkymander / CoreSploit
  Initial Commit of Coresploit
  ☆56Updated 3 years ago
• mobdk / Sigma
  Execute shellcode with ZwCreateSection, ZwMapViewOfSection, ZwOpenProcess, ZwMapViewOfSection and ZwCreateThreadEx
  ☆14Updated 3 years ago
• TheWover / donut-demos
  Demos of Donut used in conferences, etc. Mostly for my use, but free for others to use as a reference.
  ☆31Updated 5 years ago
• SolomonSklash / SeasideBishop
  A C port of b33f's UrbanBishop
  ☆38Updated 4 years ago
• ThunderGunExpress / Reflective_PSExec
  ☆45Updated 6 years ago
• Apr4h / GetInjectedThreads
  C# Implementation of Jared Atkinson's Get-InjectedThread.ps1
  ☆53Updated 3 years ago
• rvrsh3ll / RuralBishop
  D/Invoke port of UrbanBishop
  ☆29Updated 4 years ago