Kernel process termination using Microsoft's own signed driver.
☆56Aug 10, 2026Updated 2 months ago
Alternatives and similar repositories for DefenderKiller
Users that are interested in DefenderKiller are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender.☆28Jul 14, 2026Updated 3 months ago
- CVE-2026-50343 InstallService StaticPluginMap EoP - standard user to SYSTEM☆48Jul 16, 2026Updated 3 months ago
- BOF exploiting the Visual Studio Installer Elevation Service for SYSTEM LPE and persistence via AppDomainManager hijacking, with native E…☆88Aug 5, 2026Updated 2 months ago
- One-pass anonymous Active Directory enumeration over SAMR and LSARPC — null session, no credentials, with structured reusable output.☆69Sep 17, 2026Updated last month
- Custom Adaptix-compatible C2 agent - PIC beacon + Stardust UDRL + Go extender plugins☆144Oct 4, 2026Updated 2 weeks ago
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- example use of defining your own injection technique for explicit injection and or spawn (fork & run)☆19Jan 3, 2026Updated 9 months ago
- Local privilege-escalation proof of concept for the Windows WalletService vulnerability fixed in July 2026.☆58Jul 20, 2026Updated 2 months ago
- CVE 1-day in http.sys☆39Sep 4, 2026Updated last month
- CVE-2026-50522 PoC☆43Aug 15, 2026Updated 2 months ago
- A tool that helps change the recovery configuration of a Windows service to make lateral movement more stealthy☆58Feb 8, 2026Updated 8 months ago
- Command and control framework☆40Jun 20, 2026Updated 3 months ago
- A poor man's attempt to replicate the shellcode execution technique demo'd by @3lk during STHACK 2026 (https://www.youtube.com/watch?v=al…☆24Updated this week
- ☆92Aug 5, 2026Updated 2 months ago
- A collection of techniques for process injection on Windows☆104Aug 16, 2026Updated 2 months ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- PoC for CVE-2026-3609 - XIGNCODE3 xhunter1.sys handle leak enabling PPL bypass and LSASS dumping☆39May 12, 2026Updated 5 months ago
- A community maintained repository of Beacon Object Files (BOFs) for red team operations, research, and education. Our goal is to provide …☆33Aug 8, 2026Updated 2 months ago
- Shellcode Loader for Master Thesis☆74Jul 5, 2026Updated 3 months ago
- Cobalt Strike BOF for extracting Firefox passwords and cookies. Decrypts saved credentials using NSS, supports key3.db/key4.db, logins.js…☆42Jul 5, 2026Updated 3 months ago
- Rust C2 agent for Mythic that produces polymorphic shellcode: per-build function shuffle + ChaCha20-encrypted data sections; no_std/no_ma…☆76May 13, 2026Updated 5 months ago
- A foundational C library for building operationally credible offensive capabilities☆94Sep 21, 2026Updated 3 weeks ago
- ☆37Sep 6, 2026Updated last month
- Powershell & Javascript Obfuscator☆49Aug 24, 2026Updated last month
- Better version of SharpPick☆13Aug 29, 2025Updated last year
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Offensive PoC tool for BTR.sys - Microsoft Defender's Boot Time Removal Tool. Supporting material for the BTR Reforged research (Black Ha…☆146Aug 20, 2026Updated last month
- A CET-compatible Windows x64 loader that produces fully backed call stacks through runtime function table manipulation, code cave injecti…☆134Sep 6, 2026Updated last month
- BYOVD tool for manipulating Windows Protected Process Light (PPL) protection at the kernel level.☆98May 25, 2026Updated 4 months ago
- Local Windows credential extraction☆25Jul 14, 2026Updated 3 months ago
- CVE-2026-45504 Microsoft Exchange File Read☆64Jun 24, 2026Updated 3 months ago
- Windows C/C++ development environment on Linux☆18Mar 29, 2026Updated 6 months ago
- Indirect Syscall implementation to bypass userland NTAPIs hooking.☆84Aug 13, 2024Updated 2 years ago
- A talk about finding your own path to vulnerability research and your first CVE.☆16Apr 4, 2026Updated 6 months ago
- Abuses the Credential Provider interface to steal plaintext passwords from logonui.exe via CredProvDataModel.dll hooks☆73Updated this week
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- DynLoader A modular Windows loader focused on EDR evasion Built with indirect syscall (Tartarus Gate / Hell’s Gate), Manual PE parsing …☆82Jul 10, 2026Updated 3 months ago
- Pure PowerShell port of PassTheCert tool to authenticate to an LDAP/S server with a certificate through Schannel☆19May 22, 2026Updated 4 months ago
- PPLReaper is a Windows UNSIGNED kernel driver + userland companion tool designed to inspect and manipulate Protected Process Light (PPL) …☆25Mar 4, 2026Updated 7 months ago
- Listen to your binaries☆16Jul 17, 2026Updated 3 months ago
- Volatility 3 ported to Rust. Same output, much faster.☆197Oct 6, 2026Updated last week
- Adaptix C2 extender to support Cobalt Strike Malleable C2 profiles☆54Jun 28, 2026Updated 3 months ago
- CVE-2026-42980 PUBLIC EXPLOIT + RESEARCH☆143Jul 7, 2026Updated 3 months ago