Alternatives and similar repositories for exe_who:

Users that are interested in exe_who are comparing it to the libraries listed below

• ChoiSG / OneDriveUpdaterSideloading
  Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post
  ☆91Updated 2 years ago
• HuskyHacks / RustyProcessInjectors
  Just some Rust process injector POCs, nothing weird.
  ☆80Updated 3 years ago
• deepinstinct / AMSI-Unchained
  Unchain AMSI by patching the provider’s unmonitored memory space
  ☆89Updated 2 years ago
• Wh04m1001 / DiagTrackEoP
  ☆88Updated 2 years ago
• xforcered / Detect-Hooks
  Proof of concept Beacon Object File (BOF) that attempts to detect userland hooks in place by AV/EDR
  ☆99Updated 3 years ago
• xenoscr / SysWhispers2
  AV/EDR evasion via direct system calls.
  ☆107Updated last year
• zblurx / impersonate-rs
  Rusty Impersonate
  ☆95Updated last year
• klezVirus / NimlineWhispers3
  A tool for converting SysWhispers3 syscalls for use with Nim projects
  ☆144Updated 2 years ago
• S3cur3Th1sSh1t / NimShellcodeFluctuation
  ShellcodeFluctuation PoC ported to Nim
  ☆75Updated 2 years ago
• 0xsp-SRD / callback_injection-Csharp
  this repo is to cover the other undocumented or published / in different langaue to achieve shellcode injection via windows callback func…
  ☆85Updated 2 years ago
• x42en / sysplant
  Your syscall factory
  ☆121Updated 3 weeks ago
• 0xTriboulet / ZeroTotal
  A collection of source code, binaries, and compilation scripts designed to bypass detection
  ☆25Updated 2 years ago
• frkngksl / NiCOFF
  COFF and BOF Loader written in Nim
  ☆172Updated 2 years ago
• naksyn / ProcessStomping
  A variation of ProcessOverwriting to execute shellcode on an executable's section
  ☆147Updated last year
• evilashz / CheeseOunce
  Coerce Windows machines auth via MS-EVEN
  ☆158Updated last year
• Crypt0s / DelegationBOF
  ☆139Updated 2 years ago
• zimawhit3 / HellsGateNim
  A quick example of the Hells Gate technique in Nim
  ☆95Updated 3 years ago
• mmnoureldin / UnmanagedPowerShell
  ☆28Updated 2 years ago
• waawaa / AMSI_Rubeus_bypass
  ☆62Updated 2 years ago
• oldboy21 / JayFinder
  Find DLLs with RWX section
  ☆78Updated last year
• S4ntiagoP / donut
  Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…
  ☆112Updated last year
• ajpc500 / NimlineWhispers2
  A tool for converting SysWhispers2 syscalls for use with Nim projects
  ☆119Updated 3 years ago
• EspressoCake / DLL-Hijack-Search-Order-BOF
  DLL Hijack Search Order Enumeration BOF
  ☆147Updated 3 years ago
• S4ntiagoP / freeBokuLoader
  A simple BOF that frees UDRLs
  ☆117Updated 2 years ago
• Nariod / laz-y
  Automating payload generation for OSEP labs and exam.
  ☆34Updated 2 years ago
• pwnsauc3 / RWXfinder
  The program uses the Windows API functions to traverse through directories and locate DLL files with RWX section
  ☆100Updated last year
• CodeXTF2 / PyHmmm
  Simple PoC Python agent to showcase Havoc C2's custom agent interface. Not operationally safe or stable. Released with accompanying blog …
  ☆80Updated last year
• MayerDaniel / profiler-lateral-movement
  Lateral Movement via the .NET Profiler
  ☆80Updated 4 months ago
• jfmaes / AmsiHooker
  Hookers are cooler than patches.
  ☆170Updated 3 years ago
• EspressoCake / BeaconDownloadSync
  ☆92Updated 2 years ago