A Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes.
☆31Aug 12, 2026Updated 2 months ago
Alternatives and similar repositories for ALPC-Enumerator
Users that are interested in ALPC-Enumerator are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ANIMO Azure Network Intel & Mission Ops a C2 based on Azure/Entra assessments☆93Sep 16, 2026Updated last month
- A CET-compatible Windows x64 loader that produces fully backed call stacks through runtime function table manipulation, code cave injecti…☆134Sep 6, 2026Updated last month
- Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender.☆28Jul 14, 2026Updated 3 months ago
- ☆37May 19, 2026Updated 4 months ago
- ☆49Oct 4, 2026Updated 2 weeks ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Application-scoped Windows network brownouts in native C and BOF form☆23Aug 18, 2026Updated 2 months ago
- A ConfuserEx2 deobfuscator with support for anti tamper, compressor, constants, control flow, and resource recovery.☆44Jul 29, 2026Updated 2 months ago
- Beacon Object File (BOF) implementation of the dnscmd.exe functionality used to obtain remote code execution on an ADIDNS server by explo…☆57Jul 8, 2026Updated 3 months ago
- OneDrive as a covert C2 transport for Cobalt Strike☆77Sep 19, 2026Updated 3 weeks ago
- A lexer and parser for Sleep☆21Feb 20, 2026Updated 7 months ago
- Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK.☆28Updated this week
- SysTrace - Linux System Call Monitor using PTRACE API , It traces system calls, monitors process, file, network, and memory activity, det…☆25Sep 1, 2026Updated last month
- Passive backdoor implant that sniffs for a covert magic-packet trigger and runs tasks written in a custom 23-opcode bytecode command lang…☆57Aug 26, 2026Updated last month
- Windows Portable Device COM BOF☆17Mar 30, 2026Updated 6 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- NØW is a word-based shellcode encoding and obfuscation tool that transforms raw shellcode bytes into natural-looking English prose.☆92Jun 24, 2026Updated 3 months ago
- A New Exploitation Technique for Visual Studio Projects☆13Nov 5, 2023Updated 2 years ago
- Busybox-style Beacon Object Files for *nix post-exploitation. Reimplements common Unix utilities as BOFs for use in stripped environments…☆45Jun 14, 2026Updated 4 months ago
- A defensive decompilation layer: Ghidra facts, lifted into runnable Python & artifacts aiding analysis.☆16Aug 7, 2026Updated 2 months ago
- Usermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more.☆90Jun 15, 2026Updated 4 months ago
- POC pre-auth RCE on Exchange☆185Aug 22, 2026Updated last month
- Demonstration of the DLL party process injection technique☆87Oct 1, 2026Updated 2 weeks ago
- Process Impairment Exploit Chain.☆36Aug 12, 2026Updated 2 months ago
- SOCKS-focused NTLM relay with persistent session packages and a long-lived SessionBank that owns authenticated TCP connections.☆41Aug 3, 2026Updated 2 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- ☆34Sep 17, 2026Updated last month
- Gadget scanner that finds ROP gadgets inside any Windows DLL☆47Jun 18, 2026Updated 4 months ago
- Research notes on Windows Component Object Model (COM) attack surface for offensive security and vulnerability research. Covers COM hijac…☆164Jul 20, 2026Updated 2 months ago
- Pass-the-Passkey Family of Attacks☆233Sep 14, 2026Updated last month
- ☆12Feb 26, 2025Updated last year
- Static analyzer for Flutter/Dart AOT snapshots — recovers function names, class hierarchies, call graphs, and behavioral signals from lib…☆39Oct 10, 2026Updated last week
- Library that provides Python examples for interacting with the Cobalt Strike REST API☆25Nov 26, 2025Updated 10 months ago
- A JavaScript Obfuscator based on Cryptographic Indistinguishability Obfuscation techniques☆60Updated this week
- P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an executi…☆241Jul 8, 2026Updated 3 months ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- APISignature is a plugin for x64dbg that help the malware analysts & reverse engineers during analysis by adding a reference for more tha…☆38Aug 15, 2026Updated 2 months ago
- Obfuscator obfuscate using pure java bytecode virtual machine to interpret mutated java bytecodes of original java program.☆53Sep 11, 2026Updated last month
- Deep insights into EDR detection approaches☆104Updated this week
- Querying And Deleting Shadow Copies Using The IOCTL_VOLSNAP_QUERY_NAMES_OF_SNAPSHOTS & IOCTL_VOLSNAP_DELETE_SNAPSHOT IOCTLs☆22Aug 7, 2025Updated last year
- .NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on dis…☆41Oct 11, 2026Updated last week
- Proof of Concept for Process Code Injection Without Using WriteProcessMemory☆151Sep 27, 2026Updated 3 weeks ago
- EDRUnChoker - fileless WMI defense that removes EDRChoker QoS throttling policies☆49Jun 8, 2026Updated 4 months ago