EDR & AV Bypass Arsenal— a comprehensive collection of tools, patches, and techniques for evading modern EDR and antivirus defenses.
☆80Nov 17, 2025Updated 11 months ago
Alternatives and similar repositories for Bypass-Protection0x00
Users that are interested in Bypass-Protection0x00 are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- PoC shellcode injector using clean syscalls to bypass user-mode hooks in ntdll.dll☆15Jul 27, 2025Updated last year
- Remote administration toolkit for windows, based on Hidden VNC: file manager, keystroke logger, powershell☆53Nov 23, 2025Updated 11 months ago
- Collection of scripts and a binary agent for automated reconnaissance scanning, SSH/Telnet propagation, and C2 control☆16Aug 26, 2025Updated last year
- Linux Rootkit (x86-64 / ARM64) that stealth hides processes, files, and sockets, hooks syscalls, encrypts traffic, and bypasses SELinux /…☆31Aug 24, 2025Updated last year
- 渗透测试人员可以通过此BOF，将非托管 Windows可执行文件加载到Beacon内存中并执行它们，检索输出并将其呈现在 Beacon 控制台中☆13Mar 18, 2025Updated last year
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Red Team Arsenal - a comprehensive collection of tools, scripts, and techniques for conducting red team operations and adversary simulati…☆88Mar 18, 2026Updated 7 months ago
- Experimental Lightweight Windows pure C Beacon CodeName: BlackBasalt for LazyOwn RedTeam Framework C2☆12Oct 8, 2026Updated 3 weeks ago
- Misc Windows Driver/Kernel PoCs that do not need a separate repo.☆14May 4, 2025Updated last year
- ☆10May 26, 2026Updated 5 months ago
- PandaCrypter is a C#-based tool designed to convert PowerShell scripts into obfuscated batch files (.bat) with encryption and additional …☆55Aug 16, 2025Updated last year
- Minimalistic HTTP(S) client for the NT kernel☆61Dec 1, 2025Updated 11 months ago
- Havoc BOF implementation of BYOVD attack to terminate PPL-protected EDR processes using a signed Microsoft kernel driver.☆42Apr 6, 2026Updated 6 months ago
- A WIP Mythic agent that uses Crystal Palace to build its payloads.☆17Jul 26, 2026Updated 3 months ago
- A way to maintain long-term access to Windows LAPS for lateral movement in AD via installing an Offensive LAPS RPC backdoor on a DC.☆32Jun 9, 2025Updated last year
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Advanced Command and Control Framework for Authorized Red Team Operations☆58Mar 1, 2026Updated 8 months ago
- A PoC Cobalt Strike UDRL written in Rust☆35Sep 12, 2026Updated last month
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆13May 11, 2026Updated 5 months ago
- Rendering on external windows via hijacking thread contexts, with notes on ValidateHwnd☆14Jul 9, 2020Updated 6 years ago
- Sophisticated In-Memory PE loader for Cobalt Strike☆24Jan 24, 2026Updated 9 months ago
- Example of call stack spoofing trough the construction of syntetic frames and stack manipulation☆45Jan 17, 2026Updated 9 months ago
- Misery Loader to bypass modern EDR solutions☆19Dec 20, 2024Updated last year
- SilentChrome-BOF is a BOF (Beacon Object File) that silently installs a browser extension into Chrome or Edge by modifying the Preference…☆30Apr 3, 2026Updated 7 months ago
- Beacon Object File (BOF) for Windows Session Hijacking via IHxHelpPaneServer COM☆72Dec 25, 2025Updated 10 months ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Implementing Ghostly-Hollowing using tampered syscalls for remote PE injection☆77Dec 26, 2025Updated 10 months ago
- Two C# RunPE's capable of x86 and x64 injections☆10Dec 2, 2018Updated 7 years ago
- ☆17Aug 13, 2025Updated last year
- Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.☆167Jul 30, 2025Updated last year
- A Patchless AMSI Bypass Technique using VEH²☆33Jun 22, 2025Updated last year
- Malicious powershell scripts loader designed to avoid detection.☆64Jun 16, 2023Updated 3 years ago
- Kernel Process Termination Tool ( CVE-2026-0828 exploit)☆38Apr 2, 2026Updated 7 months ago
- ADSIsearch is a Beacon Object File (BOF) to query Active Directory using ADDS, ADSI, and Network Management WinAPIs.☆10Feb 23, 2025Updated last year
- ☆15Sep 11, 2017Updated 9 years ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- A WIP shellcode loader tool which bypasses AV/EDR, coded in C++, and equipped with a minimal builder.☆87Sep 27, 2025Updated last year
- Open Source implementation of PsPipeJack☆27May 27, 2026Updated 5 months ago
- ☆10Sep 19, 2024Updated 2 years ago
- A tool that supports finding and abusing whitelisted programs to allow arbitrary file writing into the executable folder of Antivirus sof…☆95May 3, 2026Updated 6 months ago
- BOF with Synthetic Stackframe☆274Oct 30, 2025Updated last year
- Async BOF for NTLMv2 Hash Snooping from ETW☆13Apr 2, 2026Updated 7 months ago
- Run native PE or .NET executables entirely in-memory. Build the loader as an .exe or .dll—DllMain is Cobalt Strike UDRL-compatible☆279Jun 18, 2025Updated last year