Alternatives and similar repositories for AMSI-patches-learned-till-now:

Users that are interested in AMSI-patches-learned-till-now are comparing it to the libraries listed below

• ScriptIdiot / sleepmask_PatchlessHook
  Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW
  ☆84Updated 2 years ago
• lap1nou / CLR_Heap_encryption
  ☆98Updated last year
• securifybv / BOFRyptor
  ☆122Updated last year
• xforcered / BOFMask
  ☆125Updated last year
• waawaa / AMSI_Rubeus_bypass
  ☆62Updated 2 years ago
• ewby / Mockingjay_BOF
  Cobalt Strike + Brute Ratel C4 Beacon Object File (BOF) Conversion of the Mockingjay Process Injection Technique
  ☆151Updated last year
• oldboy21 / JayFinder
  Find DLLs with RWX section
  ☆79Updated last year
• Mav3rick33 / ZenLdr
  Basic implementation of Cobalt Strikes - User Defined Reflective Loader feature
  ☆100Updated 2 years ago
• xalicex / LOLDrivers_finder
  ☆82Updated last year
• EspressoCake / Defender-Exclusions-Creator-BOF
  ☆80Updated last year
• rasta-mouse / PPEnum
  Simple BOF to read the protection level of a process
  ☆115Updated last year
• wolfcod / lsassdump
  lsassdump via RtlCreateProcessReflection and NanoDump
  ☆81Updated 6 months ago
• trustedsec / PPLFaultDumpBOF
  ☆140Updated last year
• NtDallas / OdinLdr
  Cobaltstrike Reflective Loader with Synthetic Stackframe
  ☆114Updated 2 months ago
• racoten / BetterNetLoader
  A version of NetLoader, Execute Assemblies and Bypass ETW and AMSI using Hardware Breakpoints
  ☆86Updated 3 months ago
• snovvcrash / BOFs
  Beacon Object Files (not Buffer Overflows)
  ☆54Updated 2 years ago
• MayerDaniel / profiler-lateral-movement
  Lateral Movement via the .NET Profiler
  ☆81Updated 5 months ago
• inb1ts / birdnet-poc
  Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.
  ☆39Updated last year
• REDMED-X / InjectKit
  Modified versions of the Cobalt Strike Process Injection Kit
  ☆94Updated last year
• ChoiSG / OneDriveUpdaterSideloading
  Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post
  ☆91Updated 2 years ago
• Octoberfest7 / JumpSession_BOF
  Beacon Object File allowing creation of Beacons in different sessions.
  ☆80Updated 2 years ago
• Maldev-Academy / DRMBinViaOrdinalImports
  Create Anti-Copy DRM Malware
  ☆55Updated 8 months ago
• passthehashbrowns / Being-A-Good-CLR-Host
  ☆55Updated 3 months ago
• eversinc33 / Godmode
  Tool for playing with Windows Access Token manipulation.
  ☆54Updated 2 years ago
• passthehashbrowns / BOFMask
  ☆120Updated last year
• EspressoCake / DLL-Exports-Extraction-BOF
  DLL Exports Extraction BOF with optional NTFS transactions.
  ☆82Updated 3 years ago
• MrAle98 / Sliver-CPPImplant2
  Sliver agent rewritten in C++
  ☆45Updated 7 months ago
• parzel / GoSleepyCrypt
  In-memory sleep encryption and heap encryption for Go applications through a shellcode function.
  ☆39Updated last year
• shantanu561993 / DLL-Sideload
  ☆40Updated 2 years ago
• Tw1sm / SQL-BOF
  Library of BOFs to interact with SQL servers
  ☆163Updated 2 weeks ago