Alternatives and similar repositories for PS-MOTW

Users that are interested in PS-MOTW are comparing it to the libraries listed below

• joe-desimone / rep-research
  ☆76Updated last year
• CaptainNox / Hypnos
  A more reliable way of resolving syscall numbers in Windows
  ☆53Updated last year
• netero1010 / SCCMVNC
  A tool to modify SCCM remote control settings on the client machine, enabling remote control without permission prompts or notifications.…
  ☆95Updated 10 months ago
• jdu2600 / Get-InjectedThreadEx
  Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2
  ☆45Updated last year
• oldboy21 / JayFinder
  Find DLLs with RWX section
  ☆81Updated 2 years ago
• cpu0x00 / EternelSuspention
  a simple poc showcasing the ability of an admin to suspend EDR's protected processes , making it useless
  ☆39Updated last year
• zero2504 / FrostLock-Injection
  FrostLock Injection is a freeze/thaw-based code injection technique that uses Windows Job Objects to temporarily freeze (suspend) a targe…
  ☆26Updated 4 months ago
• Slowerzs / CryptDecryptMemory
  ☆31Updated 8 months ago
• klezVirus / koppeling-p
  Adaptive DLL hijacking / dynamic export forwarding - EAT preserve
  ☆78Updated last year
• caueb / ThreadlessStompingKann
  Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.
  ☆65Updated last year
• Idov31 / NidhoggScript
  NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg
  ☆47Updated last year
• MaorSabag / Paruns-Fart
  Just another ntdll unhooking using Parun's Fart technique
  ☆75Updated 2 years ago
• nothingspecialforu / EvtPsst
  EvtPsst
  ☆55Updated last year
• Fitretech-Security / dylight
  macOS dylib stager
  ☆36Updated 7 months ago
• OffenseTeacher / Steganim
  ☆47Updated 2 years ago
• y-security / stealthguardian
  StealthGuardian is a middleware layer that can be combined with adversary simulation tools to verify the resistance, detection level and…
  ☆19Updated last year
• Faran-17 / Hellshazzard
  Indirect Syscall implementation to bypass userland NTAPIs hooking.
  ☆77Updated last year
• SafeBreach-Labs / MagicDot
  A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue
  ☆99Updated last year
• HullaBrian / COMmander
  .NET tool used to enrich RPC telemetry
  ☆96Updated 2 months ago
• itaymigdal / PichichiH0ll0wer
  Nim process hollowing loader
  ☆59Updated last month
• ricardojoserf / NativeTokenImpersonate
  Impersonate Tokens using only NTAPI functions
  ☆79Updated 4 months ago
• MythicAgents / forge
  Command Augmentation support for BOFs and .NET assemblies across agents
  ☆32Updated 2 months ago
• ghostbyt3 / BYOVDFinder
  Identifies LOLDrivers that are not blocked by the active HVCI policy — ideal for BYOVD scenarios.
  ☆68Updated last month
• pulpocaminante / PPL-0day
  Demoting PPL anti-malware services to less than a guest user
  ☆64Updated 7 months ago
• EvilBytecode / EvilByte-Remote-AMSI-Bypass
  Bypasses AMSI protection through remote memory patching and parsing technique.
  ☆49Updated 3 months ago
• decoder-it / ChgPass
  ☆133Updated 6 months ago
• mez-0 / citadel
  A Payload Analysis Framework
  ☆84Updated 2 months ago
• Teach2Breach / early_cascade_inj_rs
  early cascade injection PoC based on Outflanks blog post, in rust
  ☆60Updated 9 months ago
• t94j0 / sddl_py
  Parse SDDL strings
  ☆36Updated last year
• hlldz / misc
  miscellaneous codes
  ☆35Updated last year