tasox / CSharp_Process_Injection
☆70Updated last year
Alternatives and similar repositories for CSharp_Process_Injection:
Users that are interested in CSharp_Process_Injection are comparing it to the libraries listed below
- Patch AMSI and ETW☆236Updated 10 months ago
- An App Domain Manager Injection DLL PoC on steroids☆167Updated last year
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆112Updated last year
- POC for frustrating/defeating Malware Analysts☆154Updated 2 years ago
- Patching AmsiOpenSession by forcing an error branching☆144Updated last year
- CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files (BOF) for Cobalt Strike to perform process inject…☆229Updated 2 years ago
- A fake AMSI Provider which can be used for persistence.☆148Updated 3 years ago
- reflectively load and execute PEs locally and remotely bypassing EDR hooks☆151Updated last year
- C# porting of SysWhispers2. It uses SharpASM to find the code caves for executing the system call stub.☆104Updated last year
- Evasive Process Hollowing Techniques☆137Updated 4 years ago
- A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…☆158Updated 10 months ago
- A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…☆172Updated 2 years ago
- Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post☆91Updated 2 years ago
- Experiment on reproducing Obfuscate & Sleep☆143Updated 4 years ago
- UI for creating LNKs☆102Updated 3 years ago
- Overwrite a process's recovery callback and execute with WER☆103Updated 2 years ago
- A collection of various and sundry code snippets that leverage .NET dynamic tradecraft☆141Updated 10 months ago
- A new AMSI Bypass technique using .NET ALI Call Hooking.☆187Updated 2 years ago
- Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctype…☆113Updated last year
- C# code to Sandbox Defender (and most probably other AV/EDRs).☆163Updated 2 years ago
- Dynamically invoke arbitrary unmanaged code from managed code without P/Invoke.☆154Updated last year
- A tool for converting SysWhispers3 syscalls for use with Nim projects☆146Updated 2 years ago
- Do some DLL SideLoading magic☆79Updated last year
- ☆133Updated last year
- EDRSandblast-GodFault☆257Updated last year
- An example of using Syscalls in C# to get a meterpreter shell.☆108Updated 3 years ago
- NativePayload_CallBackTechniques C# Codes (Code Execution via Callback Functions Technique, without CreateThread Native API)☆117Updated last year
- Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes☆103Updated 2 years ago
- Building and Executing Position Independent Shellcode from Object Files in Memory☆157Updated 4 years ago
- Source generator to add D/Invoke and indirect syscall methods to a C# project.☆176Updated last year