A curated list of awesome LOLBins, GTFO projects, and similar 'Living Off the Land' security resources.
☆210Feb 7, 2026Updated last month
Alternatives and similar repositories for awesome-lolbins-and-beyond
Users that are interested in awesome-lolbins-and-beyond are comparing it to the libraries listed below
Sorting:
- Awesome list of Living off the Land (LOL) methods, tools, and features commonly abused by attackers☆34Feb 28, 2026Updated last week
- A Mythic agent for Windows written in C☆159Mar 1, 2026Updated last week
- Repository to gather the BOF files I will be developing☆11Oct 1, 2024Updated last year
- ☆92May 15, 2024Updated last year
- Living off the land searches for explorer and sharepoint☆93Dec 7, 2025Updated 3 months ago
- Lifetime AMSI bypass.☆36Apr 21, 2025Updated 10 months ago
- Collect Windows telemetry for Maldev☆460Jan 30, 2026Updated last month
- This repository contains detailed adversary simulation APT campaigns targeting various critical sectors. Each simulation includes custom …☆1,051Updated this week
- ☆57Dec 13, 2024Updated last year
- Simulate the behavior of AV/EDR for malware development training.☆564Feb 15, 2024Updated 2 years ago
- Parent Process ID Spoofing, coded in CGo.☆24Apr 21, 2025Updated 10 months ago
- Living Off Security Tools☆59Nov 23, 2025Updated 3 months ago
- Alternative Read and Write primitives using Rtl* functions the unintended way.☆79Aug 25, 2025Updated 6 months ago
- Kooky cURL-powered replacement for reverse shell via /dev/tcp☆79Updated this week
- Identify common EDR processes, directories, and services. Simple BOF of Invoke-EDRChecker.☆129Oct 4, 2024Updated last year
- an Improoved Version of 0xNinjaCyclone´s EarlyCascade Code☆22Feb 20, 2025Updated last year
- Abusing Azure services over C2☆367Jan 20, 2026Updated last month
- NukeAMSI is a powerful tool designed to neutralize the Antimalware Scan Interface (AMSI) in Windows environments.☆176Dec 19, 2025Updated 2 months ago
- ☆62Dec 13, 2025Updated 2 months ago
- WolfPack combines the capabilities of Terraform and Packer to streamline the deployment of red team redirectors on a large scale.☆150Jun 5, 2025Updated 9 months ago
- Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …☆103Mar 27, 2025Updated 11 months ago
- Living Off the Foreign Land setup scripts☆74Feb 26, 2025Updated last year
- AV/EDR Lab environment setup references to help in Malware development☆425Feb 19, 2025Updated last year
- ☆22Jan 31, 2023Updated 3 years ago
- MaLDAPtive is a framework for LDAP SearchFilter parsing, obfuscation, deobfuscation and detection.☆336Aug 7, 2024Updated last year
- A Beacon Object File (BOF) is a compiled C program, written to a convention that allows it to execute within a Beacon process and use int…☆252Nov 24, 2025Updated 3 months ago
- DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely☆382Dec 13, 2024Updated last year
- BOF and Python3 implementation of technique to unbind 445/tcp on Windows via SCM interactions☆345Nov 19, 2024Updated last year
- ☆15Oct 29, 2024Updated last year
- Helper script for BloodHound to automatically add relationships between multiple accounts owned by the same individual☆14Jul 13, 2022Updated 3 years ago
- Kubernetes, Clusters and Dockers Enumeration in GCP and AWS environments☆12Nov 23, 2023Updated 2 years ago
- A Dynamic MSBuild task to help with minor obfuscation of C# Binaries to evade static signatures on each compilation☆38Dec 7, 2025Updated 3 months ago
- A secure sandbox environment for malware developers and red teamers to test payloads against detection mechanisms before deployment. Inte…☆1,317Nov 12, 2025Updated 3 months ago
- Nuke It From Orbit - remove AV/EDR with physical access☆274Dec 8, 2024Updated last year
- Awesome EDR Bypass Resources For Ethical Hacking☆1,490Jan 26, 2026Updated last month
- This comprehensive process injection series is crafted for cybersecurity enthusiasts, researchers, and professionals who aim to stay at t…☆436May 22, 2025Updated 9 months ago
- Small toolkit for extracting information and dumping sensitive strings from Windows processes☆117Jul 17, 2024Updated last year
- Scanning tool for identifying local privilege escalation issues in vulnerable MSI installers☆126Sep 12, 2024Updated last year
- ☆59Oct 24, 2024Updated last year