volexity / donut-decryptor
Retrieve inner payloads from Donut samples
☆96Updated last year
Alternatives and similar repositories for donut-decryptor
Users that are interested in donut-decryptor are comparing it to the libraries listed below
Sorting:
- Windows Persistence IT-Security☆100Updated 2 months ago
- Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …☆103Updated last month
- Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.☆94Updated last week
- Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…☆141Updated 9 months ago
- BadExclusionsNWBO is an evolution from BadExclusions to identify folder custom or undocumented exclusions on AV/EDR☆76Updated last year
- IoctlHunter is a command-line tool designed to simplify the analysis of IOCTL calls made by userland software targeting Windows drivers.☆101Updated last year
- ☆87Updated last year
- Curated list of public Beacon Object Files(BOFs) build in as submodules for easy cloning☆129Updated 3 weeks ago
- I have documented all of the AMSI patches that I learned till now☆72Updated last month
- ☆154Updated 5 months ago
- Simple EDR that injects a DLL into a process to place a hook on specific Windows API☆91Updated last year
- ☆76Updated 2 years ago
- An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution☆187Updated 5 months ago
- Embedder is a collection of sources in different languages to embed Python interpreter with minimal dependencies☆120Updated 11 months ago
- Local & remote Windows DLL Proxying☆164Updated 11 months ago
- ☆119Updated last year
- PoC for using MS Windows printers for persistence / command and control via Internet Printing☆147Updated last year
- This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.☆78Updated 8 months ago
- .NET Post-Exploitation Utility for Abusing Explicit Certificate Mappings in ADCS☆144Updated 3 months ago
- ☆92Updated last year
- A BOF to enumerate system process, their protection levels, and more.☆116Updated 5 months ago
- A collection of tools and detections for the Sliver C2 Frameworj☆126Updated 2 years ago
- Tool for viewing NTDS.dit☆163Updated 2 months ago
- A Mythic Agent written in PIC C.☆189Updated 3 months ago
- Adversary Emulation Framework☆98Updated 9 months ago
- StoneKeeper C2, an experimental EDR evasion framework for research purposes☆201Updated 4 months ago
- Example code samples from our ScriptBlock Smuggling Blog post☆90Updated 11 months ago
- Find .net assemblies locally☆113Updated 2 years ago
- A C# port from Invoke-GhostTask☆115Updated last year
- Webcam capture capability for Cobalt Strike as a BOF, with in-memory download options☆137Updated last month