naksyn / ModuleShiftingLinks
Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctypes
☆116Updated last year
Alternatives and similar repositories for ModuleShifting
Users that are interested in ModuleShifting are comparing it to the libraries listed below
Sorting:
- ☆136Updated last year
- ☆122Updated last year
- ☆124Updated last year
- ☆184Updated last year
- Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post☆94Updated 2 years ago
- ☆125Updated 9 months ago
- Simple BOF to read the protection level of a process☆114Updated 2 years ago
- Malware?☆70Updated 7 months ago
- Patch AMSI and ETW in remote process via direct syscall☆81Updated 3 years ago
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆113Updated last year
- ☆111Updated 4 months ago
- A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…☆169Updated 2 years ago
- Do some DLL SideLoading magic☆83Updated last year
- ☆106Updated 4 months ago
- Find DLLs with RWX section☆81Updated last year
- ☆125Updated last year
- A variation of ProcessOverwriting to execute shellcode on an executable's section☆148Updated last year
- RDLL for Cobalt Strike beacon to silence sysmon process☆88Updated 2 years ago
- ForsHops☆136Updated 2 months ago
- Lateral Movement via the .NET Profiler☆82Updated 6 months ago
- reflectively load and execute PEs locally and remotely bypassing EDR hooks☆152Updated last year
- Construct the payload at runtime using an array of offsets☆63Updated 11 months ago
- CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking☆227Updated last year
- Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes☆106Updated 2 years ago
- Implant drop-in for EDR testing☆139Updated last year
- Improved version of EKKO by @5pider that Encrypts only Image Sections☆119Updated 2 years ago
- ☆99Updated last year
- Your syscall factory☆123Updated last week
- I have documented all of the AMSI patches that I learned till now☆72Updated 2 months ago
- AzureAD beacon object files☆119Updated 5 months ago