vxCrypt0r / VoidmawLinks
A new technique that can be used to bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders implemented by C2 beacons) or other problematic executables that will be flagged by the antimalware programs(such as mimikatz).
☆317Updated 9 months ago
Alternatives and similar repositories for Voidmaw
Users that are interested in Voidmaw are comparing it to the libraries listed below
Sorting:
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆350Updated 5 months ago
- DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely☆371Updated 7 months ago
- Use hardware breakpoint to dynamically change SSN in run-time☆261Updated last year
- ☆260Updated last year
- Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.☆285Updated last year
- ☆401Updated 7 months ago
- Nameless C2 - A C2 with all its components written in Rust☆268Updated 9 months ago
- kernel callback removal (Bypassing EDR Detections)☆177Updated 3 months ago
- Bypass Credential Guard by patching WDigest.dll using only NTAPI functions☆243Updated 3 months ago
- Abusing mhyprotect to kill AVs / EDRs / XDRs / Protected Processes.☆398Updated last year
- Sleep obfuscation☆229Updated 7 months ago
- Windows rootkit designed to work with BYOVD exploits☆200Updated 5 months ago
- Waiting Thread Hijacking - injection by overwriting the return address of a waiting thread☆222Updated last month
- early cascade injection PoC based on Outflanks blog post☆220Updated 8 months ago
- A PowerShell console in C/C++ with all the security features disabled☆256Updated last month
- A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.☆191Updated last year
- Ghosting-AMSI☆205Updated 2 months ago
- Reflective DLL Injection Made Bella☆228Updated 6 months ago
- Utilizing TLS callbacks to execute a payload without spawning any threads in a remote process☆262Updated last year
- Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry☆418Updated 11 months ago
- Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …☆265Updated 11 months ago
- ☆12Updated 6 months ago
- Evasive shellcode loader☆375Updated 8 months ago
- Some POCs for my BYOVD research and find some vulnerable drivers☆260Updated last month
- Collect Windows telemetry for Maldev☆364Updated last week
- Open Source C&C Specification☆262Updated 4 months ago
- ☆303Updated 8 months ago
- Injecting DLL into LSASS at boot☆129Updated 2 months ago
- Huffman Coding in Shellcode Obfuscation & Dynamic Indirect Syscalls Loader.☆264Updated 3 months ago
- Stealthily inject shellcode into an executable☆231Updated 3 weeks ago