1146 matches found
swarmer
swarmer A tool for sneakily adding registry keys to HKCU without EDR/AV being able to see what's happening even if you don't have administrator access. How do I use this? NOTE: You will only get to do this ONCE, afterNTUSER.MAN is your new registry hive you CANNOT change it without being an admin...
VEN0m-Ransomware
VEN0m Ransomware https://github.com/user-attachments/assets/5a1fc9b5-a647-41f6-a152-7b9d97381adc This project demonstartes how a legit, and signed driver can be weponized to evade defenses and deploy ransomware simulating a real cyberattack. π¨ Tested on Windows 11 Pro 24H2. Fully undetectable as ...
SharpToken
SharpToken During red team lateral movement, we often need to steal the permissions of other users. Under the defense of modern EDR, it is difficult for us to use Mimikatz to obtain other user permissions, and if the target user has no process alive, we have no way to use "OpenProcessToken" to...
BadExclusionsNWBO
BadExclusions Now With Better Opsec BadExclusionsNWBO is an evolution from BadExclusions to identify folder custom or undocumented exclusions on AV/EDR. How it works? BadExclusionsNWBO copies and runs HookChecker.exe in all folders and subfolders of a given path. You need to have HookChecker.exe ...
Neton
Neton - A sandbox information gathering tool Neton is a tool for getting information from Internet connected sandboxes. It is composed by an agent and a web interface that displays the collected information. The Neton agent gets information from the systems on which it runs and exfiltrates it via...
Nerv0usR4bbit
Ι΄α΄Κα΄ 0α΄s Κ4ΚΚΙͺα΄ Automated Pα΄sα΄ Exα΄Κα΄Ιͺα΄α΄α΄Ιͺα΄Ι΄ EΙ΄α΄α΄α΄Κα΄α΄Ιͺα΄Ι΄ α΄α΄α΄Κ for Windows target Author : @34zY /!\ NEW PORTABLE VERSION AVAILABLE SOON. ---------------------------------------------------------------------------- | .--, \ π° | \ / | \ / | | / ,/ /\ \ π | \ 2.0 Windows ' . ' -. | | . ' " . | | /β-.-...
thirdeye
Third Eye Usermode WDAMONITOR/WDAEXCLUDEFROMCAPTURE bypasser using undocumented Windows functions with C bindings. Starring: PEB walking Halo's Gate Custom PE sections Undocumented Windows functions Quick and dirty EDR/AV evasion 2/72 on VirusTotal Direct syscalls Getting Started Install the...
Phantom-Evasion-Loader
SROP-Assisted Cross-Memory Attach CMA Injection via Direct Syscalls. π» Phantom-Evasion-Loader x64 Linux Phantom-Evasion-Loader is a standalone, pure x64 Assembly injection engine engineered to minimize the detection surface of modern EDR/XDR solutions and Kernel-level monitors like Falco eBPF. It...
acheron
About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...
LoadReload
LoadReload Shellcode Loader based on what i did for my Master Thesis, designed for Sliver-Shellcode smaller than 25MB..... !Note Features: Multibyte-XOR Decryption of Payload Fetches Payload locally Anti-Emulation by BusySleep-Function via KUSERSHAREDDATA RW-RX-Loop for EDR-Deconditioning / Wasti...
Threat-Remediation-Scripts
Introduction Since 2021, I have developed a number of scripts to assist me with my investigations and remediation efforts. I figured, why not share them to the public, in hopes it helps you. How do these scripts work? The scripts I developed are intended to work with Crowdstrike Endpoint Detectio...
obex
Obex - DLL Blocking Obex is a PoC tool/technique that can be used to prevent unwanted modules e.g., EDR or monitoring libraries from being loaded into a newly started process during process initialization or at runtime. Features Spawns any process with arguments under debug control. Blocks a...
EtwSessionHijacking
EtwSessionHijacking: A Poc on blocking Procmon from monitoring network events Demo: https://user-images.githubusercontent.com/111295429/186082150-32ed304b-ba45-42a4-8baa-37dd75246c68.mp4 Based On : Design Issues Of Modern EDRs: Bypassing ETW-Based Solutions...
blindsight
blindsight "There's no such things as survival of the fittest. Survival of the most adequate, maybe. It doesn't matter whether a solution's optimal. All that matters is whether it beats the alternative." -- Peter Watts, Blindsight 2006 Red teaming tool to dump LSASS memory, bypassing basic...
EDRChoker
EDRChoker EDRChoker uses Policy-based Quality of Service QoS to set hard bandwidth caps throttling on Endpoint Detection and Response EDR agents, causing them to always time out - effectively blocking them. The rules take effect immediately and persist after the target reboots Windows. EDRChoker...
EDRPrison
EDRPrison Co-Author: @oops4githttps://github.com/oops4git EDRPrison leverages a legitimate WFP callout driver, WinDivert, to effectively silence EDR systems. Drawing inspiration from tools like Shutter, FireBlock, and EDRSilencer, this project focuses on network-based evasion techniques. Unlike i...
Voidgate
VOIDGATE Description: A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes such as msfvenom by performing on-the-fly decryption of individual encrypted assembly instructions, thus rendering memory scanners useless for that...
Invoke-ArgFuscator
ββββββββββββββββββββββββββ βββββββββββββββββββββββββββββββββββββββββββ ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ Invoke-ArgFuscator Invoke-ArgFuscator is an open-source, cross-platform PowerShell module that helps generate obfuscated command-lines for common...
ExecIT
ExecIT Description DLL Shellcode self-inyector/runner based on HWSyscalls, ideally thought to be executed with rundll32. May grant fileless execution if victim endpoint has access to attacker-controlled SMB share. Usage rundll32.exe ExecIT.dll, HelperFunc, Detection Currently it is fully undetect...
rusty_drivers
RustyDrivers This project is a BYOVD collection with the focus on killing EDR / AV processes. Currently the following drivers are supported: Driver| Argument Name| Blocked ---|---|--- Process Explorer| processexplorer| Yes Genshin Impact| genshin| Yes Rentdrv2| rentdrv2| No TrueSight| truesight| ...