MaliciousMacroGenerator

Malicious Macro Generator Utility Simple utility design to generate obfuscated macro that also include a AV / Sandboxes escape mechanism. Requirement Python 2.7 Usage MMG.Malicious Macro Generator v2.0 - RingZer0 Team Author: Mr.Un1k0d3r [email protected] Usage: MMG.py config output optional...

OffensiveVBA

OffensiveVBA In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques. The list got longer and longer and I found no central place for offensive VBA templates - so this repo can be used for such. It is very far away...

Salsa-tools

/ / / / / / / / \ / / / / / / / / / / / / / / // / // / / / / // / // / //,///,/ // //// Salsa Tools - An AV-Safe Reverse Shell dipped on bellota sauce Salsa Tools is a collection of three different tools that combined, allows you to get a reverse shell on steroids in any Windows environment...

AV-EDR-Killer

AV/EDR Killer https://github.com/user-attachments/assets/1eda3340-2af2-4136-b74e-be7a3f4b3924 This project demonstartes how a legit, and signed driver can be weponized to gain kernel level access. 🚨 The vulnerable driver: wsftprm.sys , signed by TPZ SOLUCOES DIGITAIS LTDA, and previously exposed ...

UnhookMe

UnhookMe - Dynamically unhooking imports resolver In the era of intrusive AVs and EDRs that introduce hot-patches to the running processes for their enhanced optics requirements, modern adversaries must have a robust tool to slide through these watchguards. The propsed implementation of dynamic...

hades

About Hades is a proof of concept loader that combines several evasion technques with the aim of bypassing the defensive mechanisms commonly used by modern AV/EDRs. Usage The easiest way, is probably building the project on Linux using make. git clone https://github.com/f1zm0/hades && cd hades ma...

ShellGhost

ShellGhost A memory-based evasion technique which makes shellcode invisible from process start to end. Motivation I wanted to share this shellcode self-injection POC to showcase some AV/EDR evasion concepts that may turn useful for Red Teaming. Just a few weeks ago I came up with a custom in-memo...

EXOCET-AV-Evasion

EXOCET - AV-evading, undetectable, payload delivery tool Chang Tan AWS Certified Cloud Practitioner and Solutions Architect Associate [email protected] Updated EXOCET Usage Make sure you pack your payloads to avoid any leaks of the crypter's key and further frustrate malware analysts. A...

slopShell

slopShell php webshell Since I derped, and forgot to talk about usage. Here goes. For this shell to work, you need 2 things, a victim that allows php file uploadyourself, in an educational environment and a way to send http requests to this webshell the client script is the 100% best way to...

TheFatRat

TheFatRat A Massive Exploiting Tool TheFatRat is an exploiting tool which compiles a malware with famous payload, and then the compiled maware can be executed on Linux , Windows , Mac and Android. TheFatRat Provides An Easy way to create Backdoors and Payload which can bypass most anti-virus...

Registry-Recon

Registry-Recon Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon. Author: Jess Hires Description As a red-team practitioner, we are often using tools that attempt to fingerprint details about a compromised system, preferably in the most stealthy way possible. Some of our usual...

AV-EDR-Lab-Environment-Setup

Configuración del entorno de laboratorio AV/EDR Tomado inicialmente del Discord de Maldev Academy y se añadieron más recursos. Notas de Notion: https://an0nud4y.notion.site/AV-EDR-Lab-Env-Setup-130bc870022d8071935cc682d3eb34b9?pvs=4 Un ejemplo de cosas que se pueden usar para emular ciertas...

shad0w

SHAD0W SHAD0W 是一个模块化 C2 框架，旨在成功运行于成熟环境中。 它采用多种方法规避 EDR 和 AV，同时允许操作者继续使用他们熟悉的工具和技术。它由 Python 3.8 和 C 驱动，并使用 Donut 生成有效载荷。通过结合 Donut 与 SHAD0W 的进程注入能力，操作者可以在内存中完全执行 .NET 程序集、DLL、EXE、JS、VBS 或 XSL。大量使用动态解析的系统调用来避免用户态 API 挂钩，利用反 DLL 注入技术使 EDR 难以将其代码加载到信标中，并采用官方 Microsoft 缓解方法来保护生成的进程。 安装与使用说明请参阅 wiki。...

ThreatCheck

ThreatCheck Matterpreter 的 DefenderCheck 修改版。 接受一个二进制文件（从磁盘文件或 URL 输入），将其分割，直到精确定位目标引擎将标记的确切字节，并将其打印到屏幕上。在尝试识别工具/载荷中的具体恶意代码段时，这非常有用。 C:\ThreatCheck.exe --help -e, --engine Default: Defender Scanning engine. Options: Defender, AMSI -f, --file Analyze a file on disk -u, --url Analyze a file from a...

BetterXencrypt

\ \ / |/ | \ / / ../ | | | // \ \ / \ \ // \ / / \ | | /\ | || \ | //\ \ | /\ | / || /|| / / / / / / / / || BetterXencrypt A better version of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs. cause Xencrypt is not FUD anymore and easily get caught by...

ransomware-simulator

QuickBuck - Ransomware Simulator / \ / / / / / / // // // // // // '// |/ // // // '/ \\,/// ///\// ,/ ///\ Nextron Systems GmbH The goal of this repository is to provide a simple, harmless way to check your AV's protection on ransomware. This tool simulates typical ransomware behaviour,...

CarbonCopy

CarbonCopy A tool which creates a spoofed certificate of any online website and signs an Executable for AV Evasion. Works for both Windows and Linux Prerequisites In order to use it on Linux, please execute commands below: apt-get install osslsigncode pip3 install pyopenssl...

RustHound

This version is only compatible withBloodHound Legacy 4.x Version compatible withBloodHound Community Edition CE can be found here RustHound-CE. Summary Limitation Description How to compile it? Using Makefile Using Dockerfile Using Cargo Linux x8664 static version Windows static version from Lin...

blindsight

blindsight "No existe la supervivencia del más apto. Supervivencia del más adecuado, quizás. No importa si una solución es óptima. Lo único que importa es si supera a la alternativa." -- Peter Watts, Blindsight 2006 Herramienta de red team para volcar la memoria de LSASS, evadiendo contramedidas...

zombie-zip

Zombie ZIP Técnica de confusión de formato ZIP que evade el 98 % de los motores antivirus. CVE-2026-0866 | VU976247 | Publicado el 10 de marzo de 2026 La técnica Crea un archivo ZIP donde: Compression Method = 0 STORED Actual data = DEFLATE compressed CRC-32 = Checksum of uncompressed payload AV...