EDR & AV Bypass Arsenal— a comprehensive collection of tools, patches, and techniques for evading modern EDR and antivirus defenses.
☆78Nov 17, 2025Updated 8 months ago
Alternatives and similar repositories for Bypass-Protection0x00
Users that are interested in Bypass-Protection0x00 are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- PoC shellcode injector using clean syscalls to bypass user-mode hooks in ntdll.dll☆15Jul 27, 2025Updated 11 months ago
- Remote administration toolkit for windows, based on Hidden VNC: file manager, keystroke logger, powershell☆46Nov 23, 2025Updated 8 months ago
- Collection of scripts and a binary agent for automated reconnaissance scanning, SSH/Telnet propagation, and C2 control☆16Aug 26, 2025Updated 11 months ago
- Linux Rootkit (x86-64 / ARM64) that stealth hides processes, files, and sockets, hooks syscalls, encrypts traffic, and bypasses SELinux /…☆28Aug 24, 2025Updated 11 months ago
- Red Team Arsenal - a comprehensive collection of tools, scripts, and techniques for conducting red team operations and adversary simulati…☆86Mar 18, 2026Updated 4 months ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- PandaCrypter is a C#-based tool designed to convert PowerShell scripts into obfuscated batch files (.bat) with encryption and additional …☆52Aug 16, 2025Updated 11 months ago
- Advanced Command and Control Framework for Authorized Red Team Operations☆57Mar 1, 2026Updated 4 months ago
- Minimalistic HTTP(S) client for the NT kernel☆61Dec 1, 2025Updated 7 months ago
- A way to maintain long-term access to Windows LAPS for lateral movement in AD via installing an Offensive LAPS RPC backdoor on a DC.☆30Jun 9, 2025Updated last year
- Havoc BOF implementation of BYOVD attack to terminate PPL-protected EDR processes using a signed Microsoft kernel driver.☆39Apr 6, 2026Updated 3 months ago
- Rendering on external windows via hijacking thread contexts, with notes on ValidateHwnd☆14Jul 9, 2020Updated 6 years ago
- Robust Cobalt Strike shellcode loader with multiple advanced evasion features☆206Apr 21, 2025Updated last year
- Beacon Object File (BOF) for Windows Session Hijacking via IHxHelpPaneServer COM☆71Dec 25, 2025Updated 7 months ago
- A PoC Cobalt Strike UDRL written in Rust☆32Jun 20, 2026Updated last month
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Two C# RunPE's capable of x86 and x64 injections☆11Dec 2, 2018Updated 7 years ago
- Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.☆168Jul 30, 2025Updated 11 months ago
- A tool that supports finding and abusing whitelisted programs to allow arbitrary file writing into the executable folder of Antivirus sof…☆92May 3, 2026Updated 2 months ago
- Cobalt Strike module x loader x profile x wike / A public collection of open resources for Cobalt Strike (only legal use in Red Team and …☆125Jun 6, 2026Updated last month
- Implementing Ghostly-Hollowing using tampered syscalls for remote PE injection☆75Dec 26, 2025Updated 7 months ago
- SilentChrome-BOF is a BOF (Beacon Object File) that silently installs a browser extension into Chrome or Edge by modifying the Preference…☆30Apr 3, 2026Updated 3 months ago
- The first publicly shared complete Windows UEFI bootkit framework for automated Ring0 rootkit deployment and APT emulation☆151Nov 24, 2025Updated 8 months ago
- A Patchless AMSI Bypass Technique using VEH²☆32Jun 22, 2025Updated last year
- Misery Loader to bypass modern EDR solutions☆19Dec 20, 2024Updated last year
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- AD ACL Abuser for Havoc C2☆25Mar 30, 2026Updated 3 months ago
- ☆23Jan 9, 2026Updated 6 months ago
- Kernel Process Termination Tool ( CVE-2026-0828 exploit)☆37Apr 2, 2026Updated 3 months ago
- A WIP shellcode loader tool which bypasses AV/EDR, coded in C++, and equipped with a minimal builder.☆87Sep 27, 2025Updated 9 months ago
- Havoc C2 BOF port of the KslD.sys BYOVD technique. Credential extraction from lsass via physical memory — no OpenProcess, no auditable AP…☆144Apr 22, 2026Updated 3 months ago
- Modules designed to be used with the Conquest framework.☆22Updated this week
- A simple POC to show how to chain multiple callbacks via tail calls to artificially construct a call stack☆109May 25, 2026Updated 2 months ago
- Another BYOVD process killer. works on all EDR's. fully signed.☆286May 19, 2026Updated 2 months ago
- open source implementation of the UDC2 spec used in Cobalt Strike☆55Jul 4, 2026Updated 3 weeks ago
- End-to-end encrypted email - Proton Mail • AdSpecial offer: 40% Off Yearly / 80% Off First Month. All Proton services are open source and independently audited for security.
- ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.☆33Apr 12, 2026Updated 3 months ago
- shellcode loader☆31Jul 23, 2025Updated last year
- Example of call stack spoofing trough the construction of syntetic frames and stack manipulation☆35Jan 17, 2026Updated 6 months ago
- A single byte modification in the kernel memory bypasses and disables all core functions of the AV/EDR security solutions☆17Aug 26, 2025Updated 11 months ago
- SpicyAD is a C# Active Directory penetration testing tool designed for authorized security assessments. It combines multiple AD attack te…☆100Jun 25, 2026Updated last month
- Porting of NPPSPY by Grzegorz Tworek to 'man in the middle' the user logon process, and store the user's name and password in an unassumi…☆20Apr 24, 2023Updated 3 years ago
- A BOF designed to inspect processes memory and addresses☆40Apr 19, 2026Updated 3 months ago