Alternatives and similar repositories for AMSI_Lines

Users that are interested in AMSI_Lines are comparing it to the libraries listed below

• SaadAhla / PSpersist
  Dropping a powershell script at %HOMEPATH%\Documents\WindowsPowershell\ , that contains the implant's path , and whenever powershell pro…
  ☆85Updated last year
• 0xsp-SRD / 0xsp.com
  a variety of tools,scripts and techniques developed and shared with different programming languages by 0xsp Lab
  ☆63Updated 6 months ago
• susMdT / SharpAgent
  C# havoc implant
  ☆101Updated 2 years ago
• naksyn / ProcessStomping
  A variation of ProcessOverwriting to execute shellcode on an executable's section
  ☆148Updated last year
• foxlox / hypobrychium
  Duplicate not owned Token from Running Process
  ☆72Updated last year
• 0xAbdullah / Offensive-Snippets
  A repository with my code snippets for research/education purposes.
  ☆50Updated last year
• mertdas / SharpLateral
  Lateral Movement
  ☆124Updated last year
• eversinc33 / Invoke-Pre2kSpray
  Enumerate domain machine accounts and perform pre2k password spraying.
  ☆70Updated last year
• lefayjey / SharpSQLPwn
  C# tool to identify and exploit weaknesses within MSSQL instances in Active Directory environments
  ☆111Updated 3 years ago
• Octoberfest7 / Presentations
  Slide decks and/or materials from conference presentations
  ☆56Updated 2 years ago
• pwnsauc3 / RWXfinder
  The program uses the Windows API functions to traverse through directories and locate DLL files with RWX section
  ☆105Updated last year
• eversinc33 / SharpStartWebclient
  Programmatically start WebClient from an unprivileged session to enable that juicy privesc.
  ☆75Updated 2 years ago
• n0tspam / RunspaceLoader
  Launches a limited shell using PowerShell Runspaces with an optional AMSI Bypass. Does not invoke Powershell.exe
  ☆13Updated last year
• HuskyHacks / SharpTokenFinder
  C# implementation of TokenFinder. Steal M365 access tokens from Office Desktop apps
  ☆140Updated 11 months ago
• amauricio / junkshell
  ☆70Updated 3 months ago
• powerseb / PowerExtract
  ☆118Updated 3 months ago
• OmriBaso / WTSImpersonator
  WTSImpersonator utilizes WTSQueryUserToken to steal user tokens by abusing the RPC Named Pipe "\\pipe\LSM_API_service"
  ☆119Updated last year
• casp3r0x0 / LoaderGate
  a C# implementation for a shellcode loader that capable to bypass Cortex XDR and Sophos EDR.
  ☆61Updated last month
• CodeXTF2 / PyHmmm
  Simple PoC Python agent to showcase Havoc C2's custom agent interface. Not operationally safe or stable. Released with accompanying blog …
  ☆82Updated last year
• Octoberfest7 / lnk_generator
  Small project to facilitate creation of .lnk payloads
  ☆70Updated 2 years ago
• pracsec / AmsiScanner
  A tool for interacting with the Anti-Malware Scan Interface API for pen testing purposes.
  ☆62Updated last year
• BC-SECURITY / ScriptBlock-Smuggling
  Example code samples from our ScriptBlock Smuggling Blog post
  ☆91Updated last year
• KINGSABRI / ServerlessRedirector
  Serverless Redirector in various cloud vendor for red team
  ☆72Updated 2 years ago
• MzHmO / DebugAmsi
  DebugAmsi is another way to bypass AMSI through the Windows process debugger mechanism.
  ☆97Updated last year
• kymb0 / Stealth_shellcode_runners
  ☆56Updated last year
• MaorSabag / SideLoadingDLL
  Do some DLL SideLoading magic
  ☆84Updated last year
• ChoiSG / OneDriveUpdaterSideloading
  Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post
  ☆98Updated 2 years ago
• NotMedic / Invoke-Nanodump
  HelpSystems Nanodump, but wrapped in powershell via Invoke-ReflectivePEInjection
  ☆56Updated 3 years ago
• Sq00ky / RunAsPasswd
  A RunAs clone with the ability to specify the password as an argument.
  ☆112Updated 2 years ago
• smokeme / ansible-havoc
  Scripts I use to deploy Havoc on Linode and setup categorization and SSL
  ☆40Updated last year