RefleXXion

Einleitung RefleXXion ist ein Dienstprogramm, das dabei helfen soll, User-Mode-Hooks zu umgehen, die von AV/EPP/EDR usw. verwendet werden. Um die User-Mode-Hooks zu umgehen, sammelt es zunächst die Syscall-Nummern von NtOpenFile, NtCreateSection, NtOpenSection und NtMapViewOfSection, die im...

RustyWater-ShellCode-Dropper

RustyWater ShellCode Dropper RustyWater representa o payload principal e a espinha dorsal de toda a operação adversarial nos ataques do grupo Static Kitten. RustyWater é um executável compilado em Rust disfarçado como reddit.exe com um ícone falso do Cloudflare conhecido como RustyWater ou...

VEN0m-Ransomware

VEN0m Ransomware https://github.com/user-attachments/assets/5a1fc9b5-a647-41f6-a152-7b9d97381adc Dieses Projekt demonstriert, wie ein legitimer, signierter Treiber bewaffnet werden kann, um Verteidigungen zu umgehen und eine Ransomware bereitzustellen, die einen echten Cyberangriff simuliert. 🚨...

PythonMemoryModule

PythonMemoryModule Implémentation pure-Python de la technique MemoryModule pour charger une dll ou un exécutable non managé entièrement depuis la mémoire « Python memory module » - Image générée par IA - hotpot.ai Qu'est-ce que c'est PythonMemoryModule est un portage Python via ctypes de la...

Skrull

Skrull Skrull एक मैलवेयर DRM है, जो AV/EDR द्वारा स्वचालित नमूना प्रस्तुतिकरण और कर्नेल से सिग्नेचर स्कैनिंग को रोकता है। यह लॉन्चर उत्पन्न करता है जो प्रोसेस घोस्टिंग तकनीक का उपयोग करके पीड़ित पर मैलवेयर चला सकते हैं। साथ ही, लॉन्चर पूरी तरह से एंटी-कॉपी होते हैं और सबमिट होने पर स्वाभाविक रूप ...

SysWhispers4

SysWhispers4 Évasion AV/EDR via appels système directs et indirects Windows NT 3.1 à Windows 11 24H2 · x64 · x86 · WoW64 · ARM64 SysWhispers4 est un générateur de stubs d'appels système basé sur Python qui produit du code C/ASM pour invoquer directement les fonctions du noyau NT, en contournant l...

TelemetrySourcerer

Telemetry Sourcerer Introdução O Telemetry Sourcerer pode enumerar e desativar fontes comuns de telemetria usadas por AV/EDR no Windows. Profissionais de equipes vermelhas e entusiastas de segurança podem usar esta ferramenta em um ambiente de laboratório para: Identificar pontos cegos baseados e...

ShellGhost

ShellGhost Une technique d'évasion basée sur la mémoire qui rend le shellcode invisible du début à la fin du processus. Motivation Je souhaitais partager cette POC d'auto-injection de shellcode pour présenter certains concepts d'évasion AV/EDR qui pourraient s'avérer utiles pour le Red Teaming. I...

UnhookMe

UnhookMe - Dynamischer Unhooking-Import-Resolver In der Ära aufdringlicher AVs und EDRs, die Hot-Patches in laufende Prozesse einbringen, um ihre erweiterten Sichtbarkeitsanforderungen zu erfüllen, benötigen moderne Angreifer ein robustes Werkzeug, um diese Wächter zu umgehen. Die vorgeschlagene...

blindsight

blindsight "Não existe isso de sobrevivência do mais forte. Sobrevivência do mais adequado, talvez. Não importa se uma solução é ótima. Tudo o que importa é se ela é melhor que a alternativa." -- Peter Watts, Blindsight 2006 Ferramenta de red team para despejar a memória do LSASS, ignorando...

DllNotificationInjection - A POC Of A New "Threadless" Process Injection Technique That Works By Utilizing The Concept Of DLL Notification Callbacks In Local And Remote Processes

DllNotificationInection is a POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and remote processes. An accompanying blog post with more details is available here: https://shorsec.io/blog/dll-notification-injection/ Ho...

Killer - Is A Tool Created To Evade AVs And EDRs Or Security Tools

It's a AV/EDR Evasion tool created to bypass security tools for learning, until now the tool is FUD. Features: Module Stomping for Memory scanning evasion DLL Unhooking by fresh ntdll copy IAT Hiding and Obfuscation & API Unhooking ETW Patchnig for bypassing some security controls Included sandbo...

Codecepticon - .NET Application That Allows You To Obfuscate C#, VBA/VB6 (Macros), And PowerShell Source Code

Codecepticon is a .NET application that allows you to obfuscate C, VBA/VB6 macros, and PowerShell source code, and is developed for offensive security engagements such as Red/Purple Teams. What separates Codecepticon from other obfuscators is that it targets the source code rather than the compil...

SysWhispers - AV/EDR Evasion Via Direct System Calls

SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported from Windows XP to 10. Example generated files available in example-output/. Introduction Various security products place hooks in user-mode APIs which allow...