wanderer

Wanderer Wanderer es un programa de código abierto que recopila información sobre los procesos en ejecución. Esta información incluye el nivel de integridad, la presencia de AMSI como módulo cargado, si se ejecuta en 64 o 32 bits, así como el nivel de privilegios del proceso actual. Esta...

dropengine

por @s0lst1c3 Versión actual: v0.1.0-alpha Compatible con Python 3.7+. Descripción general Las técnicas de evasión de defensas tienden a tener una vida útil corta, y esto es especialmente cierto para las técnicas utilizadas durante el acceso inicial. Debido a esto, los payloads de acceso inicial ...

nim-loader

nim-loader un proyecto muy tosco y en progreso de aventura aprendiendo nim combinando recursos para crear un cargador de shellcode que implementa técnicas comunes de evasión de EDR/AV. ¡Esto es un desastre y es solo con fines de investigación! Por favor, no esperes que compile y se ejecute sin tu...

hwbp4mw

Questo articolo era originariamente per VX-Underground Black Mass Halloween Edition 2022. Motori di hooking: Motore di hooking hwbp x86/x64 thread-safe c Libreria di breakpoint PAGEGUARD/hwbp c++20 Libreria hwbp esempio DLL c++20 Tecnica generica di evasione user-land x64 che utilizza i registri ...

CouchPotato

CouchPotato Assicurati di compilare da solo per evitare il rilevamento.. alcune stringhe vengono XOR al momento della compilazione.. non pubblicherò più binari. Utilizzo: CouchPotato.exe ip porta Applica patch a ETW e AMSI e utilizza syscall indirette per abusare di SeImpersonatePrivilege. Accoun...

Malicious code in @gsutevil/hta-stage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 590b3432b8d849d5772e3be7a4fbc7daeca4aa927be2d411aaf3054d9a223dc9 The package ships a Windows HTA/WSH loader that installs a remote MSI on the victim host under the control of a base URL supplied at runtime via...

MAL-2026-16419 Malicious code in @gsutevil/hta-stage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 590b3432b8d849d5772e3be7a4fbc7daeca4aa927be2d411aaf3054d9a223dc9 The package ships a Windows HTA/WSH loader that installs a remote MSI on the victim host under the control of a base URL supplied at runtime via...

sage v0.13.0

Sage Safety for Agents — Agent Detection & Response for AI coding assistants Sage is a lightweight security layer that protects AI agents from executing dangerous actions. It intercepts tool calls — shell commands, URL fetches, file writes — and checks them against multiple threat detection layer...

TALKINGEBN

|-------------------| TALKINGBEN : --- Un malware BootKit que primero realiza una escalada de privilegios en la máquina víctima. Utilizando parcheo en NtTraceEvent y AMSI escáner de búfer de memoria, lo que le permite evadir Windows Defender y cargar un payload sin ser detectado. Luego usamos...

veneficus

@abraxasnull · [email protected] · abraxaslabs.tec...

MAL-2026-15632 Malicious code in node-request-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0832f8d4554223aaaf958a5f008faa621b29c39f428c4fb042c084c05c4c7cef On npm install, package.json's postinstall runs index.js, which on Windows hosts downloads a JavaScript payload from...

nimcrypt — Updated!

nimcrypt A Sliver shellcode loader written in Nim targeting Windows x64. Two variants covering the two most common delivery situations. Tested against Windows Defender with real-time protection enabled. Variants stager Reads an encrypted shellcode blob from disk, decrypts it in memory, and...

MAL-2026-13941 Malicious code in @solana-js/web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b539591552f3e960f65ceb70d946bc56f240f9bdb1400c501723aa32fd305ec Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a...

Malicious code in @solana-js/web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b539591552f3e960f65ceb70d946bc56f240f9bdb1400c501723aa32fd305ec Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a...

AMSI - download.php Path Traversal Detection

Detects AMSI download.php?file= path traversal to /etc/passwd requires amsiweb/amsimoodle markers. !/usr/bin/env python3 -- coding: utf-8 -- """AMSI download.php path traversal.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

OffsetInspect v3.2.0

OffsetInspect A bounded-memory PowerShell toolkit for byte-offset inspection, source correlation, binary comparison, and defensive detection-boundary analysis. OffsetInspect answers a practical analyst question: What content is present at this byte offset, and what source or binary context...

Windows Gather AMSI & ETW Posture Audit

Probe AMSI blocking and ETW/PowerShell logging channels !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather AMSI & ETW Posture Audit",...

Windows Gather EDR & Defender Audit

Audit Windows Defender status, RunAsPPL, Credential Guard / VBS, AMSI availability, and common EDR process indicators. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name":...

Windows AMSI Bypass

Disable AMSI in the current PowerShell process. Variants: plain amsiInitFailed reflection, obfuscated/Base64 field names, AmsiContext patch, or AmsiScanBuffer memory patch double-add trampoline. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.stagerevasion import...

PowerShell Stager Evasion

Writes a PowerShell backdoor with optional AMSI bypass and ETW patch. Supports reverse-shell mode or shellcode stager mode VirtualAlloc + CreateThread. !/usr/bin/env python3 -- coding: utf-8 -- """ PowerShell stager with AMSI/ETW evasion prelude. Generates a .ps1 script with optional in-process...