rasta-mouse / MinHook.NET
A C# port of the MinHook API hooking library
☆50Updated last year
Related projects: ⓘ
- A care package of useful bofs for red team engagments☆47Updated last year
- A VSCode devcontainer for development of COFF files with batteries included.☆47Updated last year
- Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post☆84Updated last year
- ☆51Updated 3 years ago
- Python module for running BOFs☆63Updated last year
- a simple poc showcasing the ability of an admin to suspend EDR's protected processes , making it useless☆39Updated 2 months ago
- Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged☆86Updated 2 years ago
- ☆61Updated 2 years ago
- ☆47Updated last year
- HelpSystems Nanodump, but wrapped in powershell via Invoke-ReflectivePEInjection☆53Updated 2 years ago
- Proof of Concept code and samples presenting emerging threat of MSI installer files.☆77Updated last year
- ☆43Updated this week
- Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes☆93Updated last year
- ☆24Updated 3 years ago
- Beacon Object Files (not Buffer Overflows)☆51Updated last year
- Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.☆37Updated last year
- this repo is to cover the other undocumented or published / in different langaue to achieve shellcode injection via windows callback func…☆81Updated 2 years ago
- C# Based Universal API Unhooker - Automatically Unhook API Hives (ntdll.dll,kernel32.dll,user32.dll,and kernelbase.dll)☆21Updated last year
- I have documented all of the AMSI patches that I learned till now☆66Updated last year
- ☆50Updated this week
- ☆54Updated last month
- A BOF to parse the imports of a provided PE-file, optionally extracting symbols on a per-dll basis.☆81Updated 2 years ago
- GhostLoader - AppDomainManager - Injection - 攻壳机动队☆50Updated 4 years ago
- ☆52Updated this week
- ☆57Updated 9 months ago
- Beacon Object File allowing creation of Beacons in different sessions.☆73Updated 2 years ago
- Click Once + App Domain☆61Updated 9 months ago
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆49Updated last year
- Lockless BOF☆62Updated 7 months ago
- Rewrite to fit my needs☆25Updated last month