senzee1984 / EDRPrison
Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry
☆275Updated 3 months ago
Related projects ⓘ
Alternatives and complementary repositories for EDRPrison
- Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.☆265Updated 6 months ago
- A beacon object file implementation of PoolParty Process Injection Technique.☆321Updated 10 months ago
- Positional Independent Code to extract clear text password from mstsc.exe using API Hooking via HWBP.☆227Updated 4 months ago
- Credential Guard Bypass Via Patching Wdigest Memory☆309Updated last year
- Evasive shellcode loader☆234Updated 3 weeks ago
- Execute shellcode files with rundll32☆181Updated 9 months ago
- Bypassing UAC with SSPI Datagram Contexts☆409Updated last year
- Terminate AV/EDR Processes using kernel driver☆336Updated last year
- A Tool that aims to evade av with binary padding☆135Updated 4 months ago
- Use hardware breakpoint to dynamically change SSN in run-time☆232Updated 7 months ago
- Reproducing Spyboy technique, which involves terminating all EDR/XDR/AVs processes by abusing the zam64.sys driver☆241Updated 4 months ago
- A Go implementation of Cobalt Strike style BOF/COFF loaders.☆167Updated last month
- Process injection alternative☆299Updated 2 months ago
- A tool employs direct registry manipulation to create scheduled tasks without triggering the usual event logs.☆471Updated last year
- .NET assembly loader with patchless AMSI and ETW bypass☆276Updated last year
- A CobaltStrike toolkit to write files produced by Beacon to memory instead of disk☆426Updated 4 months ago
- not a reverse-engineered version of the Cobalt Strike Beacon☆334Updated 7 months ago
- Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime☆298Updated last year
- A list of python tools to help create an OPSEC-safe Cobalt Strike profile.☆370Updated 8 months ago
- CPP AV/EDR Killer☆352Updated 11 months ago
- A Beacon Object File (BOF) template for Visual Studio☆137Updated 2 months ago
- ☆238Updated last year
- BOF and Python3 implementation of technique to unbind 445/tcp on Windows via SCM interactions☆264Updated 3 months ago
- Collection of Beacon Object Files (BOF) for Cobalt Strike☆531Updated 3 months ago
- Dump lsass using only NTAPIS running 3 programs to create 3 JSON and 1 ZIP file... and generate the Minidump later!☆350Updated last month
- Reuse open handles to dynamically dump LSASS.☆234Updated 7 months ago
- CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files (BOF) for Cobalt Strike to perform process inject…☆227Updated last year