MemGuard v2.0 (by @prox0959) - Zero-dependency Windows EDR utility: NT kernel handle table auditor, NTDLL syscall hook detector & credential hardening engine (T1003.001).
☆18Sep 28, 2026Updated 3 weeks ago
Alternatives and similar repositories for MemGuard
Users that are interested in MemGuard are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A PoC of User-Defined Reflective Loader for Havoc Framework built with Cystal Palace☆45Oct 18, 2026Updated last week
- Enumerate user accounts and registered authentication methods via the Microsoft Self-Service Password Reset (SSPR) portal☆56Sep 15, 2026Updated last month
- A template for Rust based BOF-PEs☆25Apr 5, 2026Updated 6 months ago
- A canvas for red team infrastructure and cyber ranges. Compose a topology, export runnable Terraform and Ansible, and deploy it yourself.…☆165Oct 6, 2026Updated 2 weeks ago
- Encode shellcode as XML-looking data. Single-header C library with a two-stage PIC loader example.☆15Feb 11, 2026Updated 8 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- RingKiller — BYOD PoC for vulnerable driver DCRCVDrv.sys. Abuses IOCTL 0x2205C0 to kill arbitrary processes from ring 0 via ZwTerminatePr…☆26Sep 12, 2026Updated last month
- Windows Kernel-Mode Shellcode Development Framework (WKMSDF)☆89Aug 1, 2026Updated 2 months ago
- A sysmon configuration designed for monitoring RMM solutions from the LOLRMM framework on the OS Microsoft Windows. 10/11☆37Feb 17, 2026Updated 8 months ago
- A newly discovered vulnerable driver, pstrip64.sys (CVE-2026-29923) allows an unprivileged user to escalate privileges to SYSTEM via a cr…☆26Apr 11, 2026Updated 6 months ago
- SmuggleMyPayload generates HTML pages that embed and reconstruct files client-side using JavaScript. The toolkit offers multiple HTML Smu…☆55Oct 13, 2026Updated last week
- Set of PoC to abuse Windows minifilters functionality☆111May 1, 2026Updated 5 months ago
- PIC shellcode agent based on Stardust framework and Crystal Palace☆89Oct 4, 2026Updated 3 weeks ago
- Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK.☆37Updated this week
- Windows x64 API hashing library that bypasses EAF and resolves forwarded exports, ordinals, and api-ms-*/ext-ms-* API Set DLLs.☆66Oct 7, 2026Updated 2 weeks ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- bb-huge 🤗 , Personal bug bounty findings hub and bug bounty orchestration for multiple agents☆23Jul 11, 2026Updated 3 months ago
- ☆50Oct 4, 2026Updated 3 weeks ago
- Async BOF to capture KeePass master passwords by detecting and keylogging locked database windows.☆51Jul 23, 2026Updated 3 months ago
- Everything related to YARA☆16Apr 18, 2026Updated 6 months ago
- Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.☆109Oct 1, 2026Updated 3 weeks ago
- Automated YARA rule generation from the Cert Central compromised certificate database.☆15Updated this week
- Silent;Call — Pre-authentication remote root on Cisco CUCM 15.x (CVSS 10.0)☆29Aug 4, 2026Updated 2 months ago
- Sample WinDbg command & UI extensions.☆15Sep 28, 2026Updated 3 weeks ago
- Minimal Linux kernel fuzzer demo targeting HFS+☆12May 29, 2025Updated last year
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Serverless C2 transport plugin for AdaptixC2 v1.2 using AWS Lambda + DynamoDB as the relay infrastructure.☆30Updated this week
- Research on a new PoC for a Windows Sandbox .wsb HostFolder UNC path primitive that causes the host to authenticate over SMB and leak Net…☆32Jun 21, 2026Updated 4 months ago
- CVE-2026-8452 PreAuth RCE☆65Aug 14, 2026Updated 2 months ago
- Generate Caddy redirector configs from Cobalt Strike or Sliver C2 profiles.☆23Jul 11, 2026Updated 3 months ago
- ☆15Feb 20, 2026Updated 8 months ago
- AyedFuzzer is a small File-Format-Fuzzer with 3 options (File-mutating, WinDbg-interactive monitor, multi-processing) for windows executa…☆17Dec 2, 2024Updated last year
- PoC for WinNotify, demonstrated through a driver mapper, and local privilege escalation.☆41Sep 20, 2026Updated last month
- A Beacon Object File (BOF) for Cobalt Strike and Mythic C2 that implements COM hijacking for persistence on Windows systems.☆37Feb 17, 2026Updated 8 months ago
- Havoc BOF implementation of BYOVD attack to terminate PPL-protected EDR processes using a signed Microsoft kernel driver.☆42Apr 6, 2026Updated 6 months ago
- Open source password manager - Proton Pass • AdSecurely store, share, and autofill your credentials with Proton Pass, the end-to-end encrypted password manager trusted by millions.
- CnaEmulator is a standalone, general-purpose development, emulation, and testing harness for Cobalt Strike Aggressor Scripts (.cna)☆22Sep 20, 2026Updated last month
- Debugger utilizing stealth hooks to hide from debugger detection☆26Aug 22, 2026Updated 2 months ago
- IP obfuscation and URL generator.☆47Dec 8, 2025Updated 10 months ago
- Frameless Browser‑in‑the‑Browser (BitB) - No iframes, no frame‑busting issues. A single‑script Shadow DOM / MutationObserver library for …☆54Aug 20, 2026Updated 2 months ago
- Atomic test units for BOF execution☆62Apr 26, 2026Updated 5 months ago
- A PoC UDRL for Cobalt Strike built with Crystal Palace that combines Raphael Mudge's page streaming technique with a modular call gate (D…☆141Jan 21, 2026Updated 9 months ago
- SigLens is a Windows binary analysis tool designed to pinpoint the exact regions responsible for antivirus detections. It narrows detecti…☆42Oct 1, 2026Updated 3 weeks ago