a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Callback of sysmon driver filter. RegSaveKeyExW() and RegRestoreKeyW() API which is not included in monitoring. This POC will use
☆66Aug 23, 2023Updated 3 years ago
Alternatives and similar repositories for Reg-Restore-Persistence-Mole
Users that are interested in Reg-Restore-Persistence-Mole are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Click Once + App Domain☆69Feb 23, 2026Updated 8 months ago
- yet another sleep encryption thing. also used the default github repo name for this one.☆67May 11, 2023Updated 3 years ago
- A rust proof of concept to demonstrate registry overwriting via RegRestoreKey using the Offline Registry Library☆24Nov 13, 2025Updated 11 months ago
- Improved version of EKKO by @5pider that Encrypts only Image Sections☆124Feb 13, 2023Updated 3 years ago
- Another approach of Threadless injection discovered by @_EthicalChaos_ in c that loads a module into the target process and stomps it, an…☆189Aug 2, 2023Updated 3 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- A simple rpc2socks alternative in pure Go.☆31Jul 8, 2024Updated 2 years ago
- EDRSandblast-GodFault☆272Aug 28, 2023Updated 3 years ago
- Modify managed functions from unmanaged code☆53Feb 1, 2024Updated 2 years ago
- The standard Go net.Conn interface using Azure Storage services as the transport layer.☆32Oct 26, 2026Updated last week
- TypeLib persistence technique☆151Oct 22, 2024Updated 2 years ago
- BOF and C++ implementation of the Windows Defender sandboxing technique described by Elastic Security Labs/Gabriel Landau.☆24Jul 5, 2023Updated 3 years ago
- This program is used to perform reflective DLL Injection to a remote process specified by the user.☆60Jul 11, 2023Updated 3 years ago
- A PoC for achieving persistence via push notifications on Windows☆48Jun 9, 2023Updated 3 years ago
- GhostLoader - AppDomainManager - Injection - 攻壳机动队☆54May 21, 2020Updated 6 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Post-ex tool to interact with chromium browser when CDP is enabled☆47May 15, 2026Updated 5 months ago
- DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly☆67Mar 19, 2024Updated 2 years ago
- Busybox-style Beacon Object Files for *nix post-exploitation. Reimplements common Unix utilities as BOFs for use in stripped environments…☆84Aug 22, 2026Updated 2 months ago
- ☆30Jul 26, 2024Updated 2 years ago
- ☆85Nov 1, 2023Updated 3 years ago
- Terminate AV/EDR leveraging BYOVD attack☆105Mar 21, 2025Updated last year
- Splitting and executing shellcode across multiple pages☆102Jun 8, 2023Updated 3 years ago
- ☆142Jun 21, 2023Updated 3 years ago
- Lockless BOF☆79May 2, 2025Updated last year
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- (First Public?) Sample of unhooking ntdll (All Exports & IAT imports) hooks in Rust using in-memory disassembly, avoiding direct syscalls…☆140Mar 3, 2025Updated last year
- Porting of BOF InlineExecute-Assembly to load .NET assembly in process but with patchless AMSI and ETW bypass using hardware breakpoint.☆310Jun 12, 2026Updated 4 months ago
- Cobalt Strike + Brute Ratel C4 Beacon Object File (BOF) Conversion of the Mockingjay Process Injection Technique☆159Nov 7, 2023Updated 2 years ago
- Hiding shellcode in plain sight within a large memory region. Inspired by technique used by Raspberry Robin's Roshtyak☆209Nov 12, 2025Updated 11 months ago
- Implementation of Advanced Module Stomping and Heap/Stack Encryption☆236Jul 25, 2023Updated 3 years ago
- ☆127Sep 1, 2024Updated 2 years ago
- A crappy hook on SpAcceptLsaModeContext that prints incoming auth attempts. WIP☆37Jul 27, 2021Updated 5 years ago
- Section-based payload obfuscation technique for x64☆63Aug 8, 2024Updated 2 years ago
- Basic implementation of Cobalt Strikes - User Defined Reflective Loader feature☆100Feb 28, 2023Updated 3 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- BOF for C2 framework☆45Nov 9, 2024Updated last year
- A simple PoC to invoke an encrypted shellcode by using an hidden call☆116Nov 19, 2022Updated 3 years ago
- Select any exported function in a dll as the new dll's entry point.☆83Oct 25, 2024Updated 2 years ago
- Shellcode Loader Implementing Indirect Dynamic Syscall , API Hashing, Fileless Shellcode retrieving using Winsock2☆298Jul 15, 2023Updated 3 years ago
- RunPE implementation with multiple evasive techniques (1)☆391Sep 22, 2023Updated 3 years ago
- Local & remote Windows DLL Proxying☆172Jun 17, 2024Updated 2 years ago
- Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird …☆816Jan 26, 2026Updated 9 months ago