vxCrypt0r / VoidmawLinks
A new technique that can be used to bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders implemented by C2 beacons) or other problematic executables that will be flagged by the antimalware programs(such as mimikatz).
☆329Updated 11 months ago
Alternatives and similar repositories for Voidmaw
Users that are interested in Voidmaw are comparing it to the libraries listed below
Sorting:
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆355Updated 7 months ago
- kernel callback removal (Bypassing EDR Detections)☆188Updated 5 months ago
- ☆403Updated 9 months ago
- Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.☆289Updated last year
- ☆260Updated last year
- Use hardware breakpoint to dynamically change SSN in run-time☆267Updated last year
- Nameless C2 - A C2 with all its components written in Rust☆274Updated 11 months ago
- DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely☆379Updated 9 months ago
- A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.☆193Updated last year
- Sleep obfuscation☆233Updated 9 months ago
- Bypass Credential Guard by patching WDigest.dll using only NTAPI functions☆254Updated 5 months ago
- Open Source C&C Specification☆266Updated 6 months ago
- Abusing mhyprotect to kill AVs / EDRs / XDRs / Protected Processes.☆403Updated 2 years ago
- A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.☆317Updated 2 years ago
- Injecting DLL into LSASS at boot☆137Updated 4 months ago
- early cascade injection PoC based on Outflanks blog post☆230Updated 10 months ago
- Huffman Coding in Shellcode Obfuscation & Dynamic Indirect Syscalls Loader.☆270Updated 5 months ago
- Windows rootkit designed to work with BYOVD exploits☆205Updated 7 months ago
- .NET assembly loader with patchless AMSI and ETW bypass☆352Updated 2 years ago
- Reflective DLL Injection Made Bella☆237Updated 8 months ago
- ROP-based sleep obfuscation to evade memory scanners☆363Updated 2 months ago
- Waiting Thread Hijacking - injection by overwriting the return address of a waiting thread☆237Updated 2 weeks ago
- Stealthily inject shellcode into an executable☆265Updated 2 months ago
- Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry☆433Updated last year
- Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …☆282Updated last year
- Utilizing TLS callbacks to execute a payload without spawning any threads in a remote process☆269Updated last year
- Evasive shellcode loader☆384Updated 10 months ago
- ☆19Updated 8 months ago
- A user-mode code and its rootkit that will Kill EDR Processes permanently by leveraging the power of Process Creation Blocking Kernel Cal…☆221Updated 3 months ago
- A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…☆164Updated last year