A collection of techniques, examples and a little bit of theory for manually obfuscating PowerShell scripts to achieve AV evasion, compiled for educational purposes. The contents of this repository are the result of personal research, including reading materials online and conducting trial-and-error attempts in labs and pentests.
☆1,215Jul 19, 2024Updated 2 years ago
Alternatives and similar repositories for PowerShell-Obfuscation-Bible
Users that are interested in PowerShell-Obfuscation-Bible are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- This map lists the essential techniques to bypass anti-virus and EDR☆3,483Mar 28, 2025Updated last year
- Villain is a high level stage 0/1 C2 framework that can handle multiple reverse TCP & HoaxShell-based shells, enhance their functionality…☆4,485May 21, 2025Updated last year
- A memory-based evasion technique which makes shellcode invisible from process start to end.☆1,202Oct 16, 2023Updated 3 years ago
- The Hunt for Malicious Strings☆1,425May 13, 2025Updated last year
- Lifetime AMSI bypass☆693Sep 26, 2023Updated 3 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Awesome EDR Bypass Resources For Ethical Hacking☆1,598Jan 26, 2026Updated 9 months ago
- This repo contains some Amsi Bypass methods i found on different Blog Posts.☆2,207Nov 28, 2024Updated last year
- An ADCS Exploitation Automation Tool Weaponizing Certipy and Coercer☆750May 19, 2023Updated 3 years ago
- Shellcode encryptor & obfuscator tool☆1,048Jul 21, 2026Updated 3 months ago
- Dominate Active Directory with PowerShell.☆1,207Sep 17, 2026Updated last month
- Automated DLL Sideloading Tool With EDR Evasion Capabilities☆510Dec 19, 2023Updated 2 years ago
- Windows Local Privilege Escalation Cookbook☆1,391Feb 5, 2026Updated 8 months ago
- Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes☆1,061Jun 20, 2023Updated 3 years ago
- A tool which bypasses AMSI (AntiMalware Scan Interface) and PowerShell CLM (Constrained Language Mode) and gives you a FullLanguage Power…☆821Mar 28, 2025Updated last year
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- kill anti-malware protected processes ( BYOVD )☆1,000Jul 21, 2023Updated 3 years ago
- A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techni…☆1,427Oct 27, 2023Updated 3 years ago
- Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird …☆813Jan 26, 2026Updated 9 months ago
- A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file form…☆1,236Jun 10, 2024Updated 2 years ago
- .NET/PowerShell/VBA Offensive Security Obfuscator☆528Feb 1, 2024Updated 2 years ago
- .NET assembly loader with patchless AMSI and ETW bypass☆393Apr 19, 2023Updated 3 years ago
- a tool to help operate in EDRs' blind spots☆777Dec 2, 2024Updated last year
- PoC module to demonstrate automated lateral movement with the Havoc C2 framework.☆315Dec 9, 2023Updated 2 years ago
- EDR Lab for Experimentation Purposes☆1,579Jun 10, 2026Updated 4 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.☆631Jan 20, 2026Updated 9 months ago
- Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods☆1,471Aug 18, 2023Updated 3 years ago
- A Windows reverse shell payload generator and handler that abuses the http(s) protocol to establish a beacon-like reverse shell.☆3,504Jan 19, 2025Updated last year
- ☆717Mar 22, 2024Updated 2 years ago
- The swiss army knife of LSASS dumping☆2,143Sep 17, 2024Updated 2 years ago
- C# obfuscator that bypass windows defender☆833Jun 4, 2023Updated 3 years ago
- Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts wa…☆1,104Oct 14, 2025Updated last year
- BloodyAD is an Active Directory Privilege Escalation Framework☆2,337Oct 25, 2026Updated last week
- The Havoc Framework☆8,498Dec 18, 2025Updated 10 months ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- This repo contains C/C++ snippets that can be handy in specific offensive scenarios.☆776Jan 26, 2025Updated last year
- A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 12 methods.☆2,345Apr 24, 2026Updated 6 months ago
- Lifetime AMSI bypass by @ZeroMemoryEx ported to .NET Framework 4.8☆348Aug 29, 2024Updated 2 years ago
- Amsi Bypass payload that works on Windwos 11☆379Jul 30, 2023Updated 3 years ago
- Simple & Powerful PowerShell Script Obfuscator☆594May 13, 2025Updated last year
- Killer is a super simple tool designed to bypass AV/EDR security tools using various evasive techniques and used by Patchwork group.☆844Jul 2, 2024Updated 2 years ago
- Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows…☆2,147Dec 11, 2024Updated last year