Alternatives and similar repositories for WFH:

Users that are interested in WFH are comparing it to the libraries listed below

• airbus-cert / Invoke-Bof
  Load any Beacon Object File using Powershell!
  ☆246Updated 3 years ago
• xforcered / InlineExecute-Assembly
  InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assem…
  ☆185Updated 3 years ago
• HackingLZ / ExtractedDefender
  ☆215Updated 2 years ago
• CCob / SylantStrike
  Simple EDR implementation to demonstrate bypass
  ☆163Updated 4 years ago
• mdsecactivebreach / Farmer
  ☆358Updated 3 years ago
• bats3c / EvtMute
  Apply a filter to the events being reported by windows event logging
  ☆260Updated 3 years ago
• Allevon412 / TeamsImplant
  ☆204Updated 2 years ago
• jfmaes / AmsiHooker
  Hookers are cooler than patches.
  ☆168Updated 3 years ago
• bananabr / TimeException
  A tool to find folders excluded from AV real-time scanning using a time oracle
  ☆231Updated 11 months ago
• jfmaes / Invoke-DLLClone
  Koppeling x Metatwin x LazySign
  ☆205Updated 3 years ago
• boku7 / winx64-InjectAllProcessesMeterpreter-Shellcode
  64bit Windows 10 shellcode that injects all processes with Meterpreter reverse shells.
  ☆128Updated last year
• netbiosX / AMSI-Provider
  A fake AMSI Provider which can be used for persistence.
  ☆141Updated 3 years ago
• subat0mik / whoamsi
  An effort to track security vendors' use of Microsoft's Antimalware Scan Interface
  ☆238Updated 2 years ago
• xpn / sccmwtf
  ☆144Updated last year
• deepinstinct / Lsass-Shtinkering
  ☆376Updated 2 years ago
• pracsec / AmsiBypassHookManagedAPI
  A new AMSI Bypass technique using .NET ALI Call Hooking.
  ☆186Updated 2 years ago
• RedSiege / PersistAssist
  Fully modular persistence framework
  ☆249Updated last year
• calebstewart / bypass-clm
  PowerShell Constrained Language Mode Bypass
  ☆242Updated 3 years ago
• RiccardoAncarani / LiquidSnake
  LiquidSnake is a tool that allows operators to perform fileless lateral movement using WMI Event Subscriptions and GadgetToJScript
  ☆328Updated 3 years ago
• ustayready / wnfexec
  WNF Code Execution Library Using C#
  ☆108Updated 4 years ago
• xforcered / CredBandit
  Proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that b…
  ☆234Updated 3 years ago
• o1mate / AppLocker-Bypass
  Bypassing AppLocker with C#
  ☆137Updated 3 years ago
• am0nsec / SharpHellsGate
  C# Implementation of the Hell's Gate VX Technique
  ☆208Updated 4 years ago
• fozavci / WeaponisingCSharp-Fundamentals
  Weaponising C# - Fundamentals Training Content
  ☆70Updated 3 years ago
• WithSecureLabs / physmem2profit
  Physmem2profit can be used to create a minidump of a target hosts' LSASS process by analysing physical memory remotely
  ☆408Updated 2 years ago
• VirtualAlllocEx / Payload-Download-Cradles
  This are different types of download cradles which should be an inspiration to play and create new download cradles to bypass AV/EPP/EDR …
  ☆255Updated 2 years ago
• NVISOsecurity / brown-bags
  ☆111Updated last year
• wavvs / nanorobeus
  COFF file (BOF) for managing Kerberos tickets.
  ☆286Updated last year
• fortalice / bofhound
  Generate BloodHound compatible JSON from logs written by ldapsearch BOF, pyldapsearch and Brute Ratel's LDAP Sentinel
  ☆317Updated 11 months ago
• t3hbb / DefenderCheck
  Identifies the bytes that Microsoft Defender flags on.
  ☆79Updated 2 years ago