Alternatives and similar repositories for RT-EWS:

Users that are interested in RT-EWS are comparing it to the libraries listed below

• infosecn1nja / e2modrewrite
  Convert Empire profiles to Apache mod_rewrite scripts
  ☆28Updated 5 years ago
• djhohnstein / TSMSISrv_poc
  C# POC code for the SessionEnv dll hijack by utilizing called functions of TSMSISrv.dll
  ☆58Updated 6 years ago
• vysecurity / AzureAppC2
  A script that can be deployed to Azure App for C2 / Proxy / Redirector
  ☆37Updated 5 years ago
• tothi / PowerLessShell
  Run PowerShell command without invoking powershell.exe
  ☆35Updated 3 years ago
• freshness79 / unlock
  Microsoft Applocker evasion tool
  ☆39Updated 5 years ago
• leonjza / tc2
  treafik fronted c2 examples
  ☆26Updated 4 years ago
• checkymander / CoreSploit
  Initial Commit of Coresploit
  ☆56Updated 3 years ago
• rvrsh3ll / Sharp-Suite
  My musings with C#
  ☆28Updated 2 years ago
• vysecurity / FSharp-Shellcode
  F# Implementation to spawn shellcode
  ☆47Updated 6 years ago
• stufus / shellcode-implant-stub
  Source code in Win32 ASM and C for a shellcode execution wrapper designed to mitigate the risk of shellcode execution on a host other tha…
  ☆19Updated 9 years ago
• vletoux / RPCForSMBLibrary
  Extension of SMBLibrary for RPC calls
  ☆33Updated 10 months ago
• thesnoom / extps-cobalt-strike-bof
  Extended Process List (Search functionality)
  ☆29Updated 4 years ago
• kyleavery / scarecrow_wrapper
  ☆37Updated 3 years ago
• jnqpblc / SharpSvc
  SharpSvc is a simple code set to interact with the SC Manager API and is compatible with Cobalt Strike.
  ☆26Updated last year
• slyd0g / SharpCrashEventLog
  C# port of LogServiceCrash
  ☆46Updated 4 years ago
• fashionproof / CheckSafeBoot
  I used this to see if an EDR is running in Safe Mode
  ☆36Updated 4 years ago
• secgroundzero / tetanus
  Helper script for mangling CS payloads
  ☆51Updated 6 years ago
• bufferbandit / leak.docx
  Leak windows system info through a docx file
  ☆12Updated 5 years ago
• djhohnstein / wlbsctrl_poc
  C++ POC code for the wlbsctrl.dll hijack on IKEEXT
  ☆53Updated 6 years ago
• xforcered / xPipe
  Cobalt Strike BOF to list Windows Pipes & return their Owners & DACL Permissions
  ☆54Updated 3 years ago
• mobdk / Core
  Core bypass Windows Defender and execute any binary converted to shellcode
  ☆43Updated 3 years ago
• aaaddress1 / xlsKami
  Out-of-the-Box Tool to Obfuscate Excel XLS. Include Obfuscation & Hide for Cell Labels & BoundSheets
  ☆48Updated 3 years ago
• py7hagoras / OfficeMacro64
  This is a 64 bit VBA implementation of Christophe Tafani-Dereeper's original VBA code described in his blog @ https://blog.christophetd.f…
  ☆21Updated 5 years ago
• crawl3r / FunWithAMSI
  A repo to hold any bypasses I work on/study/whatever
  ☆19Updated 4 years ago
• invictus-0x90 / Docker-C3
  Example of running C3 (https://github.com/FSecureLABS/C3) in a Docker container
  ☆27Updated 3 years ago
• mobdk / WinBoost
  Execute Mimikatz with different technique
  ☆51Updated 3 years ago
• decoder-it / BadBackupOperator
  ☆37Updated 7 years ago
• moloch-- / DarkLoadLibrary
  LoadLibrary for offensive operations
  ☆33Updated 3 years ago
• CCob / Jboss-Wilfly-Hashes-to-Hashcat
  Converts JBoss/Wildfly management users properties file to hashcat format compatible with mode 20
  ☆12Updated 5 years ago
• ThunderGunExpress / UAC-TokenDuplication
  ☆37Updated 7 years ago