NimPackt-v1

A Nim-based packer for .NET executables and raw shellcode ByCas van Cooten @chvancooten With special thanks to Marcello Salvati @byt3bl33der and Fabian Mosch @S3cur3Th1sSh1t Description Update: NimPackt-v1 is among the worst code I have ever written I was just starting out learning Nim. Because o...

thirdeye

Third Eye Usermode WDAMONITOR/WDAEXCLUDEFROMCAPTURE bypasser using undocumented Windows functions with C bindings. Starring: PEB walking Halo's Gate Custom PE sections Undocumented Windows functions Quick and dirty EDR/AV evasion 2/72 on VirusTotal Direct syscalls Getting Started Install the...

EDRChoker

EDRChoker EDRChoker uses Policy-based Quality of Service QoS to set hard bandwidth caps throttling on Endpoint Detection and Response EDR agents, causing them to always time out - effectively blocking them. The rules take effect immediately and persist after the target reboots Windows. EDRChoker...

BYOSI

BYOSI Evade EDR's the simple way, by not touching any of the API's they hook. Theory I've noticed that most EDRs fail to scan scripting files, treating them merely as text files. While this might be unfortunate for them, it's an opportunity for us to profit. Flashy methods like residing in memory...

swarmer

swarmer A tool for sneakily adding registry keys to HKCU without EDR/AV being able to see what's happening even if you don't have administrator access. How do I use this? NOTE: You will only get to do this ONCE, afterNTUSER.MAN is your new registry hive you CANNOT change it without being an admin...

VEN0m-Ransomware

VEN0m Ransomware https://github.com/user-attachments/assets/5a1fc9b5-a647-41f6-a152-7b9d97381adc This project demonstartes how a legit, and signed driver can be weponized to evade defenses and deploy ransomware simulating a real cyberattack. 🚨 Tested on Windows 11 Pro 24H2. Fully undetectable as ...

ShellGhost

ShellGhost A memory-based evasion technique which makes shellcode invisible from process start to end. Motivation I wanted to share this shellcode self-injection POC to showcase some AV/EDR evasion concepts that may turn useful for Red Teaming. Just a few weeks ago I came up with a custom in-memo...

DarkWidow

DarkWidow A Customizable Dropper Tool targeting Windows. Honourable Mentions: 1. BlackHat Asia, 2024 - Call For Tools 2. BlackHat USA, 2024 - Call For Tools 3. BlackHat SecTor, 2024 - Call For Tools 4. BlackHat Europe, 2024 - Call For Tools 5. Wild West Hacking Fest 2024 - Arsenal Thanks a lot to...

ThreadStackSpoofer

Thread Stack Spoofing / Call Stack Spoofing PoC A PoC implementation for an advanced in-memory evasion technique that spoofs Thread Call Stack. This technique allows to bypass thread-based memory examination rules and better hide shellcodes while in-process memory. Intro This is an example...

SilentButDeadly

SilentButDeadly Overview SilentButDeadly is a network communication blocker specifically designed to neutralize EDR/AV software by preventing their cloud connectivity using Windows Filtering Platform WFP. This version focuses solely on network isolation without process termination. Blog:...

CLR-Unhook

CLR Unhooking Tool Note: For this to have the effect of a clean CLR, you’d need to manually map the DLL from disk into memory. You cannot use LoadLibraryA/W, because antivirus solutions will detect the DLL load event and may hook it immediately. If you want this behavior, you can look up existing...

Project-Onyx

Project Onyx Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advanced evasion techniques against modern EDR systems. It shifts away from traditional signature-based obfuscation towards behavioral camouflage and stri...

RustyWater-ShellCode-Dropper

RustyWater ShellCode Dropper RustyWater represents the main payload and the backbone of the entire adversarial operation in Static Kitten group attacks. RustyWater is a Rust compiled executable disguised as reddit.exe with a fake Cloudflare icon known as RustyWater or linked to Archer RAT/RUSTRIC...

CrimsonEDR

CrimsonEDR / | | | | \ | | | | | | | | | | | | | '| | ' / |/ | ' | | | | | | / | || | | | | | | | \ \ | | | | || || | | \ \ || ||| || ||//|| |||/|| \ Developed by : Matthias Ossard https://github.com/Helixo32 CrimsonEDR is an open-source project engineered to identify specific malware...

lutlol

Living Under the Land on Linux Material for talks with the same name at... BSides Belfast 2025 BSides Vienna 2025 The code isn't particularly usable as-is, but may be useful for reference. Helpful things: The src/ directory - Source code for most of the things in the talk ProcrastinationEDR -...

acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

LOLBITS

██╗ ██████╗ ██╗ ██████╗ ██╗████████╗███████╗ ██║ ██╔═══██╗██║ ██╔══██╗██║╚══██╔══╝██╔════╝ ██║ ██║ ██║██║ ██████╔╝██║ ██║ ███████╗ ██║ ██║ ██║██║ ██╔══██╗██║ ██║ ╚════██║ ███████╗╚██████╔╝███████╗██████╔╝██║ ██║ ███████║ ╚══════╝ ╚═════╝ ╚══════╝╚═════╝ ╚═╝ ╚═╝ ╚══════╝ Table of Contents About th...

MsfMania

MsfMania MsfMania is an advanced Python-based payload obfuscation framework designed to evade EDR/AV detection on Windows systems. It generates highly polymorphic executables through dynamic code generation, multi-layer encryption RC4, and binary metadata spoofing. ⚠️ Educational Purpose Only -...

ThreadlessInject

Threadless Process Injection From my Bsides Cymru 2023 talk: Needles Without the Thread. As red teamers, we always find ourselves in a cat and mouse game with the blue team. Many Anti-virus and EDR solutions over the past 10 years have become significantly more advanced at detecting fileless...

PhantomCtx

PhantomCtx PhantomCtx is a tool that automates Activation Context hijacking with the objective of loading an arbitrary DLL into the vast majority of signed executables e.g. Microsoft, Adobe, Mozilla. The loader is presented as a modern alternative to traditional DLL Hijacking & Sideloading: unlik...