naksyn / ModuleShifting
Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctypes
☆108Updated last year
Related projects ⓘ
Alternatives and complementary repositories for ModuleShifting
- A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge …☆159Updated last year
- ☆108Updated last year
- ☆133Updated last year
- ☆116Updated 2 months ago
- ☆173Updated 11 months ago
- ☆118Updated last year
- Malware?☆69Updated last month
- Simple BOF to read the protection level of a process☆104Updated last year
- A proof of concept I developed to improve Gargoyle back in 2018 to achieve true memory obfuscation from position independent code☆39Updated last month
- Implant drop-in for EDR testing☆127Updated 11 months ago
- Patch AMSI and ETW in remote process via direct syscall☆77Updated 2 years ago
- A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…☆165Updated last year
- Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post☆86Updated 2 years ago
- Do some DLL SideLoading magic☆74Updated last year
- Tool for playing with Windows Access Token manipulation.☆51Updated last year
- ☆125Updated 3 months ago
- Lateral Movement via the .NET Profiler☆73Updated 5 months ago
- ☆117Updated last year
- RDLL for Cobalt Strike beacon to silence sysmon process☆85Updated 2 years ago
- Find DLLs with RWX section☆75Updated last year
- NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg☆47Updated 8 months ago
- Improved version of EKKO by @5pider that Encrypts only Image Sections☆113Updated last year
- I have documented all of the AMSI patches that I learned till now☆68Updated last year
- A variation of ProcessOverwriting to execute shellcode on an executable's section☆145Updated 10 months ago
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆110Updated last year
- C# porting of SysWhispers2. It uses SharpASM to find the code caves for executing the system call stub.☆101Updated last year
- Your syscall factory☆122Updated last month
- A collection of various and sundry code snippets that leverage .NET dynamic tradecraft☆134Updated 5 months ago
- A C# Solution Source Obfuscator for avoiding AV signatures with minimal user interaction. Powered by the Roslyn C# library.☆69Updated 4 years ago
- Just another C2 Redirector using CloudFlare.☆78Updated 5 months ago