zimnyaa / nim-noload-dll-hollowingLinks
Unused DLL hollowing PoC in Nim
☆17Updated 3 years ago
Alternatives and similar repositories for nim-noload-dll-hollowing
Users that are interested in nim-noload-dll-hollowing are comparing it to the libraries listed below
Sorting:
- PoC XLL builder in Python/Nim☆47Updated 2 years ago
- Windows x64 Process Injection via Ghostwriting with Dynamic Configuration☆29Updated 3 years ago
- Sleep Obfuscation☆45Updated 2 years ago
- A nim port of C5pider's Ekko project.☆17Updated 2 years ago
- yet another sleep encryption thing. also used the default github repo name for this one.☆69Updated 2 years ago
- ☆41Updated 2 years ago
- Small tool to play with IOCs caused by Imageload events☆42Updated 2 years ago
- Self Delete DLL☆23Updated last year
- Your NTDLL vaccine from modern direct syscall methods.☆36Updated 3 years ago
- A simple Nim stager (w/ fiber execution)☆18Updated 3 years ago
- A method to execute shellcode using RegisterWaitForInputIdle API.☆55Updated 2 years ago
- ShellcodeFluctuation PoC ported to Nim☆78Updated 2 years ago
- ☆43Updated last year
- ☆62Updated 3 years ago
- Beacon Object Files (not Buffer Overflows)☆56Updated 2 years ago
- maldev obviously☆27Updated 4 months ago
- ☆47Updated 2 years ago
- ☆56Updated 2 years ago
- A proof-of-concept created for academic/learning purposes, demonstrating both local and remote use of VSTO "Add-In's" maliciously☆31Updated 2 years ago
- BOF and C++ implementation of the Windows Defender sandboxing technique described by Elastic Security Labs/Gabriel Landau.☆24Updated 2 years ago
- Python module for running BOFs☆72Updated 2 years ago
- all credits go to @mgeeky☆64Updated 3 years ago
- Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.☆40Updated 2 years ago
- DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly☆61Updated last year
- A repository filled with ideas to break/detect direct syscall techniques☆27Updated 3 years ago
- A reimplementation of Cobalt Strike's Beacon Object File (BOF) Loader☆55Updated last year
- Hooked create process injection for meterpreter☆23Updated 4 years ago
- A crappy hook on SpAcceptLsaModeContext that prints incoming auth attempts. WIP☆36Updated 4 years ago
- C code to enable ETW tracing for Dotnet Assemblies☆31Updated 3 years ago
- Modified Version of Melkor @FuzzySecurity capable of creating disposable AppDomains in injected processes.☆28Updated 4 years ago