vvelitkn / Evasion-Escaper
Evasion Escaper is a project aimed at evading the checks that malicious software performs to detect if it's running in a virtual environment or sandbox, and to pass all such checks successfully.
☆105Updated 2 weeks ago
Alternatives and similar repositories for Evasion-Escaper:
Users that are interested in Evasion-Escaper are comparing it to the libraries listed below
- ETW based POC to identify direct and indirect syscalls☆180Updated last year
- ☆134Updated 2 years ago
- An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…☆115Updated 7 months ago
- Exploitation of process killer drivers☆196Updated last year
- Small PoC of using a Microsoft signed executable as a lolbin.☆135Updated last year
- Finding secrets in kernel and user memory☆114Updated last year
- ☆112Updated 2 years ago
- ☆112Updated 2 years ago
- Detect strange memory regions and DLLs☆177Updated 3 years ago
- ☆92Updated 2 years ago
- Experiment on reproducing Obfuscate & Sleep☆141Updated 3 years ago
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆122Updated 2 years ago
- ☆134Updated last year
- A Poc on blocking Procmon from monitoring network events☆100Updated 2 years ago
- ☆75Updated last year
- different ntdll unhooking techniques : unhooking ntdll from disk, from KnownDlls, from suspended process, from remote server (fileless)☆185Updated last year
- It's pointy and it hurts!☆123Updated 2 years ago
- Files for http://blog.deniable.org/posts/windows-callbacks/☆69Updated 2 years ago
- Implementation of Advanced Module Stomping and Heap/Stack Encryption☆214Updated last year
- Mochi is a proof-of-concept C++ loader that leverages the ChaiScript embedded scripting language to execute code.☆99Updated 2 years ago
- EDRSandblast-GodFault☆250Updated last year
- I have documented all of the AMSI patches that I learned till now☆74Updated last year
- ShellWasp is a tool to help build shellcode that utilizes Windows syscalls, while overcoming the portability problem associated with Wind…☆165Updated last year
- Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider☆169Updated 2 years ago
- Splitting and executing shellcode across multiple pages☆99Updated last year
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆51Updated last year
- ☆49Updated 4 months ago
- Implementing the ghostly hollowing PE injection technique using tampered syscalls.☆131Updated 8 months ago
- Identify and exploit leaked handles for local privilege escalation.☆105Updated last year
- Create Anti-Copy DRM Malware☆52Updated 6 months ago