Detects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process hollowing. Built in Rust for speed. Includes CLI and TUI interfaces.
☆392Aug 7, 2026Updated 2 months ago
Alternatives and similar repositories for ghost
Users that are interested in ghost are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes.☆31Aug 12, 2026Updated 2 months ago
- ☆16Jan 15, 2026Updated 9 months ago
- How to Register your own AV with Defender☆37Aug 27, 2026Updated last month
- Passive backdoor implant that sniffs for a covert magic-packet trigger and runs tasks written in a custom 23-opcode bytecode command lang…☆57Aug 26, 2026Updated last month
- Sanctum is an experimental proof-of-concept EDR, designed to detect modern malware techniques, above and beyond the capabilities of antiv…☆567Mar 24, 2026Updated 6 months ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Context-aware Nmap reconnaissance framework with traffic intelligence and AD awareness☆25Feb 4, 2026Updated 8 months ago
- PowerShell toolkit for AMSI/Defender detection-boundary analysis and static malware triage maps byte offsets to detection triggers, plus …☆86Jul 28, 2026Updated 2 months ago
- Overview of MS Defender☆166Feb 20, 2026Updated 7 months ago
- takes shellcode bad-bytes and banishes them, returning cleaned shellcode with preserved functionalities☆63Mar 1, 2026Updated 7 months ago
- Bypassing EDR's with stealthy c++ telegram Bot and Telegram itself as C2 interface !☆44Mar 24, 2026Updated 6 months ago
- .NET tool used to enrich RPC telemetry☆102Jan 24, 2026Updated 8 months ago
- COM Windows Persistence Technique☆89Apr 27, 2026Updated 5 months ago
- template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader.☆107Jan 10, 2026Updated 9 months ago
- VDM sig bypass and additional WinAPI stubs☆21Feb 16, 2026Updated 8 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- A CET-compatible Windows x64 loader that produces fully backed call stacks through runtime function table manipulation, code cave injecti…☆134Sep 6, 2026Updated last month
- proper ntdll .text section unhooking via native api. unlike other unhookers this doesnt leave 2 ntdlls loaded. x86/x64/wow64 supported.☆56Dec 9, 2025Updated 10 months ago
- BOF to terminate a process via PID as argument☆28Sep 7, 2025Updated last year
- An aggressor script that tracks operational changes made during a red team engagement. Gives you a full audit trail of what was changed a…☆29May 21, 2026Updated 4 months ago
- Async BOF that monitors USB device connect/disconnect events, reports device information and performs actions on connected USB storage vo…☆57Jul 23, 2026Updated 2 months ago
- NoWarbird - Warbird devirtualization project☆87Aug 25, 2026Updated last month
- EDR-Redir : a tool used to redirect the EDR's folder to another location.☆245May 23, 2026Updated 4 months ago
- Proof-of-concept kernel driver that hijacks the Windows kernel extension table mechanism to preserve process notify callbacks even when a…☆97Jul 7, 2025Updated last year
- A high-fidelity x86_64 polymorphic mutation engine focused on instruction-level fragmentation and context preservation.☆112Jan 18, 2026Updated 9 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Code execution/injection technique using DLL PEB module structure manipulation☆292Jun 4, 2025Updated last year
- Red Team Coin for crypto-mining operations.☆26Mar 1, 2026Updated 7 months ago
- Stealthy x64 thread manipulation library for calling functions inside target processes without creating remote threads or installing hook…☆59Oct 10, 2025Updated last year
- 🛡️ Open-source binary protection toolkit for Windows PE. Nanomite, VM protection, anti-debug, and more.☆65Feb 8, 2026Updated 8 months ago
- IP obfuscation and URL generator.☆48Dec 8, 2025Updated 10 months ago
- CVE-2026-75604 Next.js Windows RCE poc☆105Aug 28, 2026Updated last month
- TheDarkMark is a C2 framework designed to be fast and parallel.☆24Jul 21, 2026Updated 2 months ago
- AI-powered Windows Event Log analyzer that learns from your feedback. Uses Claude AI with RAG to detect suspicious activity, improve ac…☆38Dec 18, 2025Updated 10 months ago
- Evade behavioral analysis by executing malicious code within trusted Microsoft call stacks, patchless hooking library IAT/EAT.☆149Dec 8, 2025Updated 10 months ago
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.☆36Apr 12, 2026Updated 6 months ago
- Implementing an early exception handler for hooking and threadless process injection without relying on VEH or SEH☆140Aug 31, 2025Updated last year
- Locate dlls and function addresses without PEB Walk and EAT parsing☆111Nov 7, 2025Updated 11 months ago
- Usermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more.☆90Jun 15, 2026Updated 4 months ago
- ☆17Oct 2, 2024Updated 2 years ago
- Shellcode Loader for Master Thesis☆74Jul 5, 2026Updated 3 months ago
- Pipeline for creating shellcode from a nostd rust project.☆27Jul 11, 2024Updated 2 years ago