volexity / donut-decryptor
Retrieve inner payloads from Donut samples
☆84Updated 11 months ago
Alternatives and similar repositories for donut-decryptor:
Users that are interested in donut-decryptor are comparing it to the libraries listed below
- This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.☆76Updated 4 months ago
- Local & remote Windows DLL Proxying☆161Updated 7 months ago
- A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue☆96Updated 9 months ago
- Embedder is a collection of sources in different languages to embed Python interpreter with minimal dependencies☆115Updated 7 months ago
- ☆112Updated 11 months ago
- PoC for using MS Windows printers for persistence / command and control via Internet Printing☆143Updated 8 months ago
- ☆102Updated 2 months ago
- This repo will contain the core detection, only for Cobaltstrike's leaked versions. Non-leaked version detections wont be shared☆88Updated last year
- Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…☆141Updated 5 months ago
- ☆68Updated last year
- An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution☆157Updated last month
- Example code samples from our ScriptBlock Smuggling Blog post☆87Updated 7 months ago
- Identifies bad bytes from static analysis with any Anti-Virus scanner.☆119Updated 6 months ago
- A BOF to enumerate system process, their protection levels, and more.☆111Updated last month
- Fully functional, from-scratch alternative to the Cobalt Strike Beacon (red teaming tool), offering transparency and flexibility for secu…☆181Updated 10 months ago
- StoneKeeper C2, an experimental EDR evasion framework for research purposes☆151Updated 3 weeks ago
- Simple EDR that injects a DLL into a process to place a hook on specific Windows API☆89Updated last year
- ☆180Updated last year
- A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders Stardust☆83Updated 9 months ago
- BadExclusionsNWBO is an evolution from BadExclusions to identify folder custom or undocumented exclusions on AV/EDR☆73Updated 11 months ago
- ☆92Updated last year
- To audit the security of read-only domain controllers☆114Updated last year
- Curated list of public Beacon Object Files(BOFs) build in as submodules for easy cloning☆123Updated last month
- I have documented all of the AMSI patches that I learned till now☆68Updated last year
- Project for identifying executables and DLLs vulnerable to environment-variable based DLL hijacking.☆56Updated 2 years ago
- Evade EDR's the simple way, by not touching any of the API's they hook.☆68Updated 5 months ago
- ☆219Updated last year
- "Service-less" driver loading☆147Updated last month
- Your syscall factory☆122Updated this week