acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

RedTeamCCode

RedTeamCCode Red Team C code repo Want to know what is the syscall ID been used by your system getsyscall.exe ntdll.dll NtProtectVirtualMemory ntdll.dll!NtProtectVirtualMemory at 0x00007FFDE568D010 NtProtectVirtualMemory syscall ID 0x00000050 80 CrowdStrike hooked ntdll.dll APIs...

SysWhispers

SysWhispers SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported from Windows XP to Windows 10 19042 20H2. Example generated files available in the example-output/ folder. Introduction Various security products...

makin

I create makin to make initial malware assessment little bit easier for me, I think it's useful for others as well, It helps to reveal a debugger detection techniques used by a sample. Cualquier comentario es muy apreciado: @qazqaz ¿Cómo funciona? makin abre una muestra como depurado e inyecta...

NimGetSyscallStub

NimGetSyscallStub Get fresh Syscalls from a fresh ntdll.dll copy. This code can be used as an alternative to the already published awesome tools NimlineWhispers and NimlineWhispers2 by @ajpc500 or ParallelNimcalls. The advantage of grabbing Syscalls dynamically is, that the signature of the Stubs...

HellHall

HellsHall - Another Way To Fetch Clean Syscalls HellsHall is a combination of HellsGate and indirect syscalls. How it works First, HellsHall checks whether the syscall address is hooked and tries to retrieve the syscall number by checking the presence of the following bytes: 0x4C, 0x8B, 0xD1, 0xB...

acheron

Acerca de Acheron es una librería inspirada en SysWhisper3/FreshyCalls/RecycledGate, con la mayor parte de la funcionalidad implementada en ensamblador de Go. El paquete acheron se puede usar para añadir capacidades de syscall indirecta a tus herramientas ofensivas en Golang, para eludir AV/EDR q...

rust_syscalls

RUSTSYSCALLS Single stub direct and indirect syscalling with runtime SSN resolving for windows. Features: One single line for all your syscalls Function name hashing at compilation time Direct or indirect sycalls x8664, WOW64 and x86 native support Designed to allow the implementation of custom S...

AtomicSyscall

AtomicSyscall Tools and PoCs for Windows syscall investigation. Table Of Contents AtomicSyscall HeavensGate SyscallDumper SyscallPoCs SyscallResolvers Get-SyscallNumber.ps1 Reference Acknowledgments HeavensGate This directory is for Heaven's Gate technique. See README.md SyscallDumper Back to Top...

hookchain

Hookchain Resumen - EN En el actual ecosistema de seguridad digital, donde las amenazas evolucionan con rapidez y complejidad, las empresas que desarrollan soluciones de detección y respuesta en endpoints EDR están en constante búsqueda de innovaciones que no solo sigan el ritmo, sino que también...

SysWhispers4

SysWhispers4 通过直接和间接系统调用实现 AV/EDR 规避 Windows NT 3.1 至 Windows 11 24H2 · x64 · x86 · WoW64 · ARM64 SysWhispers4 是一个基于 Python 的系统调用存根生成器，可生成 C/ASM 代码，直接调用 NT 内核函数，绕过 AV/EDR 产品在 ntdll.dll 上放置的用户态挂钩。 它继承了 SysWhispers → SysWhispers2 → SysWhispers3 的演进脉络，这一版本新增了迄今最全面的 SSN 解析策略、调用方法和规避能力。 演进：SysWhispers...

EUVD-2003-1236

Malware in sbrugna...

EUVD-2018-18079

Malware in sbrugna...

EUVD-2006-2335

Malware in sbrugna...

GuLoader Malware Utilizing New Techniques to Evade Security Software

Cybersecurity researchers have exposed a wide variety of techniques adopted by an advanced malware downloader called GuLoader to evade security software. "New shellcode anti-analysis technique attempts to thwart researchers and hostile environments by scanning entire process memory for any virtua...

NimGetSyscallStub - Get Fresh Syscalls From A Fresh Ntdll.Dll Copy

Get fresh Syscalls from a fresh ntdll.dll copy. This code can be used as an alternative to the already published awesome tools NimlineWhispers and NimlineWhispers2 by @ajpc500 or ParallelNimcalls. The advantage of grabbing Syscalls dynamically is, that the signature of the Stubs is not included i...

NimGetSyscallStub - Get Fresh Syscalls From A Fresh Ntdll.Dll Copy

Get fresh Syscalls from a fresh ntdll.dll copy. This code can be used as an alternative to the already published awesome tools NimlineWhispers and NimlineWhispers2 by @ajpc500 or ParallelNimcalls. The advantage of grabbing Syscalls dynamically is, that the signature of the Stubs is not included i...

Hunt-Sleeping-Beacons - Aims To Identify Sleeping Beacons

The idea of this project is to identify beacons which are unpacked at runtime or running in the context of another process. To do so, I make use of the observation that beacons tend to call Sleep between their callbacks. A call to sleep sets the state of the thread to DelayExecution which is take...

NimPackt-v1 - Nim-based Assembly Packer And Shellcode Loader For Opsec And Profit

ByCas van Cooten @chvancooten With special thanks to Marcello Salvati @byt3bl33der and Fabian Mosch @S3cur3Th1sSh1t Description Update: NimPackt-v1 is among the worst code I have ever written I was just starting out learning Nim. Because of this, I started on a full rewrite of NimPackt, dubbed...

SysWhispers - AV/EDR Evasion Via Direct System Calls

SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported from Windows XP to 10. Example generated files available in example-output/. Introduction Various security products place hooks in user-mode APIs which allow...