vxCrypt0r / VoidmawLinks
A new technique that can be used to bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders implemented by C2 beacons) or other problematic executables that will be flagged by the antimalware programs(such as mimikatz).
☆314Updated 8 months ago
Alternatives and similar repositories for Voidmaw
Users that are interested in Voidmaw are comparing it to the libraries listed below
Sorting:
- ☆397Updated 6 months ago
- Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.☆285Updated last year
- Collect Windows telemetry for Maldev☆356Updated 4 months ago
- Windows rootkit designed to work with BYOVD exploits☆200Updated 5 months ago
- ☆257Updated last year
- Nameless C2 - A C2 with all its components written in Rust☆267Updated 8 months ago
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆346Updated 4 months ago
- Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry☆417Updated 10 months ago
- Abusing mhyprotect to kill AVs / EDRs / XDRs / Protected Processes.☆399Updated last year
- kernel callback removal (Bypassing EDR Detections)☆177Updated 3 months ago
- Bypass Credential Guard by patching WDigest.dll using only NTAPI functions☆242Updated 2 months ago
- Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …☆261Updated 10 months ago
- A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.☆189Updated last year
- Proof of Concept for manipulating the Kernel Callback Table in the Process Environment Block (PEB) to perform process injection and hijac…☆226Updated 7 months ago
- .NET assembly loader with patchless AMSI and ETW bypass☆334Updated 2 years ago
- DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely☆369Updated 6 months ago
- ☆7Updated 5 months ago
- Open Source C&C Specification☆260Updated 3 months ago
- Evasive shellcode loader☆368Updated 8 months ago
- Reflective DLL Injection Made Bella☆228Updated 5 months ago
- Sleep obfuscation☆228Updated 6 months ago
- Some POCs for my BYOVD research and find some vulnerable drivers☆254Updated 2 weeks ago
- Slides & Code snippets for a workshop held @ x33fcon 2024☆260Updated last year
- A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…☆161Updated last year
- NyxInvoke is a Rust CLI tool for running .NET assemblies, PowerShell, and BOFs with Patchless AMSI and ETW bypass features. with Dual-bui…☆218Updated 4 months ago
- Waiting Thread Hijacking - injection by overwriting the return address of a waiting thread☆221Updated 3 weeks ago
- Tools for analyzing EDR agents☆230Updated last year
- shellcode loader for your evasion needs☆331Updated last month
- Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.☆313Updated last year
- A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes (such as msfve…☆523Updated last year