EDRSandblast

EDRSandBlast EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections Notify Routine callbacks, Object Callbacks and ETW TI provider and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring. As of...

Nim-Reverse-Shell

Nim Reverse Shell A simple reverse shell written in Nim that bypasses Windows Defender detection see the "Tested Operating Systems" section below for more details. This code is made for educational purposes only. Tested Operating Systems Windows 10 10.0.19045 Windows 11 10.0.22621 Compilation The...

fortress

One browser engine to rule them all Stealth Chromium engine · v3 Chromium 153 Fortress is a Chromium fork that stops scrapers and browser agents from getting blocked. Bot detectors flag automation by reading the browser fingerprint. Fortress corrects that fingerprint inside Chromium's C++, so the...

VBoxCloak

VBoxCloak A PowerShell script that attempts to help malware analysts hide their VirtualBox Windows VM's from malware that may be trying to evade analysis. Guaranteed to bring down your pafish ratings by at least a few points ; The script accomplishes this by doing the following: Renames several...

Ghost-In-The-Logs

Ghost In The Logs This tool allows you to evade sysmon and windows event logging, my blog post about it can be found here Usage You can grab the lastest release here Starting off Once you've got the latest version execute it with no arguments to see the avalible commands $ gitl.exe Loading the ho...

Cooolis-ms

Cooolis-ms Wiki Documentation Cooolis-ms is a code execution tool that includes a Metasploit Payload Loader, Cobalt Strike External C2 Loader, and Reflective DLL injection. It is designed to evade static detection of code we intend to execute that contains known signatures, helping red team...

Forensia

Forensia Anti Forensics Tool For Red Teamers, Used For Erasing Some Footprints In The Post Exploitation Phase. Reduces Payload Burnout And Increases Detection Countdown. Can Be Used To Test The capabilities of Your Incident Response / Forensics Teams. Capabilities Unloading Sysmon Driver. Gutmann...

Invoke-DNSteal

Invoke-DNSteal is a Simple & Customizable DNS Data Exfiltrator. This tool helps you to exfiltrate data through DNS protocol over UDP and TCP, and lets you control the size of queries using random delay. Also, allows you to avoid detections by using random domains in each of your queries and you c...

Shelltropy

Shelltropy The more predictable you are, the less you get detected A technique of hiding malicious shellcode based on low-entropy via Shannon encoding. Entropy is the measure of the randomness in a set of data here: shellcode. The higher the entropy, the more random the data is. Shannon Entropy i...

Chrono-Drip-Temporal-Viscosity-Exploitation-Framework-CVE-2022-0847

Chrono-Drip: Temporal Viscosity Exploitation Framework CVE-2022-0847 Weaponization via Convergent Time Theory CTT ⚠️ DISCLAIMER FOR RESEARCH AND ACADEMIC PURPOSES ONLY This tool demonstrates the application of fundamental physics discoveries to cybersecurity. All work presented here is theoretical...

trevorc2

trevorc2 TrevorC2 - Command and Control via Legitimate Behavior over HTTP Written by: Dave Kennedy @HackingDave Website: https://www.trustedsec.com Note that this is a very early release - heavy randomization and encryption to be added soon. TrevorC2 is a client/server model for masking command a...

claude-awm

claude-awm: can you scrub a SynthID text watermark by editing the text? Yes, but only one family of attack works, and it isn't the one everyone assumes. Unicode variation selectors category Mn, U+FE00 to U+FE0F and U+E0100 to U+E01EF drive the detector below threshold and stay there. Every other...

Pokemon-Shellcode-Loader

Pokémon Shellcode Loader Tired of looking at hex all day and popping '\x41's? Rather look at Lugia/Charmander? I have the solution for you. A tweet came in from @Checkymander about creating a shellcode loader from Pokémon names. Great fun project to mess with the blue team, but there wasn't a POC...

SliverMirage

SliverMirage A fork of CrystalSliver, extending the Crystal Palace PICO loader with dual-layer AMSI bypass, ETW silencing, and six delivery variants for Sliver C2. What it does SliverMirage wraps a Sliver implant DLL through Crystal Palace PICO virtualization, then delivers it via a loader that...

p3-loader

P³-Shellcode Loader - Process Parameter Poisoning Authors: Max Hirschberger & Ogulcan Ugur Contents 1. Introduction 2. Typical Process Injection and Involved System APIs 3. Technical Foundation of Required Windows Internals 3.1 Process Creation API and Startup Parameters 3.2 The Process Environme...

PSSW100AVB

⚡ PSSW100AVB ⚡ PowerShell Detection Evasion & Sandbox Research PowerShell Scripts With 100% AV Bypass PSSW100AVB Repository Behavioral Analysis • AV Research • Adversary Simulation PSSW100AVB Repository Description This repository contains PowerShell scripts designed for penetration testing...

rebrowser-patches

🪄 Patches for undetectable browser automation This repo contains patches to enhance popular web automation libraries. Specifically, it targets the puppeteer and playwright packages. Some aspects of automation libraries or browser behavior cannot be adjusted through settings or command-line...

Abused-Legitimate-Services

Abused Legitimate Services Legitimate third-party Platform-as-a-Service PaaS providers are becoming increasingly leveraged by threat actors for phishing and malware deployment. PaaS providers such as cloud instances, marketing platforms, content delivery networks CDN, and dynamic DNS servers have...

CTT-enhanced-VMware-vCenter

CTT-enhanced-VMware-vCenter Looking at current high-impact vulnerabilities, let's use the VMware vCenter Server CVE-2021-21972 CVSS 9.8 as our base. This is a publicly known RCE with patches available, perfect for demonstrating CTT enhancements. 🔥 What This CTT Enhancement Actually Does: 1...

BypassAV

BypassAV This map lists the essential techniques to bypass anti-virus and EDR as a reminder: it is highly recommended to read the articles related to manual techniques rather than using open source tools which are more likely to be suspected by the anti-virus because of IOSs Preview Edit the...