Percino

Percino Evasive Golang Loader Percino is a Golang loader that execute shellcode utilizing the process hollowing technique with anti-sandbox and anti-analysis measures. The shellcode is encrypted with the Triple DES 3DES encryption algorithm. Full EDR bypass with any C2 Framework. Tested with Coba...

Voidgate

VOIDGATE Description: A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes such as msfvenom by performing on-the-fly decryption of individual encrypted assembly instructions, thus rendering memory scanners useless for that...

SigFlip

What is it ? SigFlip is a tool for patching authenticode signed PE files exe, dll, sys ..etc in a way that doesn't affect or break the existing authenticode signature, in other words you can change PE file checksum/hash by embedding data i.e shellcode without breaking the file signature, integrit...

SharpBlock

SharpBlock A method of bypassing EDR's active projection DLL's by preventing entry point execution. Features Blocks EDR DLL entry point execution, which prevents EDR hooks from being placed. Patchless AMSI bypass that is undetectable from scanners looking for Amsi.dll code patches at runtime. Hos...

Blackout

Blackout leveraging gmer driver to effectively disabling or killing EDRs and AVs. it bypass HVCI fluently the sample is sourced from loldrivers https://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/ usage Place the driver Blackout.sys in the same path as the executable The...

Shhhloader

Shhhloader Shhhloader is a work in progress shellcode loader. It takes raw shellcode as input and compiles a C++ stub that does a bunch of different things to try and bypass AV/EDR. The included python builder will work on any Linux system that has Mingw-w64 installed. 1/25/24 EDIT: Shhhloader no...

CVE-2026-68820_Mass_Exploit

CVE-2026-68820 — Mass Exploit Framework Edition. Automated module for mass local privilege escalation LPE to NT AUTHORITY\SYSTEM via a use-after-free vulnerability in the AFD.sys driver ancillary function driver. This exploit is designed for corporate environments: Supports Windows 10/11 all...

awesome-edr-bypass

Awesome EDR Bypass 🛡️ Awesome EDR Bypass Resources For Ethical Hacking ⚔️ EDR bypass technology is not just for attackers. Many malware now have EDR bypass capabilities, knowledge that pentesters and incident responders should also be aware of. This repository is not intended to be used to escalate...

HWSyscalls

HWSyscalls Main Contributors Description HWSyscalls is a new method to execute indirect syscalls using 3 main components: Hardware breakpoints and Vectored Exception Handler to control the flow of execution. HalosGate is used to find syscall numbers and addresses. Creating a synthetic trampoline ...

inceptor

🚩 This is the public repository of Inceptor, for latest version and updates please consider supporting us through https://porchetta.industries/ 🚩 Sponsors If you want to sponsors this project and have the latest updates on Inceptor, latest issues fixed, latest features, please support us on...

SharpToken

SharpToken During red team lateral movement, we often need to steal the permissions of other users. Under the defense of modern EDR, it is difficult for us to use Mimikatz to obtain other user permissions, and if the target user has no process alive, we have no way to use "OpenProcessToken" to...

EDRSandblast

EDRSandBlast EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections Notify Routine callbacks, Object Callbacks and ETW TI provider and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring. As of...

PoC-CVE-2022-30190

POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina Info : New Microsoft Office zero-day used in attacks to execute PowerShell Summary On the 29th of May 2022, the NaoSec team, an independent Cyber Security Research Team, discovered a malicious Office document shared on Virustotal. This...

EDR-Preloader

EDR-Preloader An EDR bypass that prevent EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer For details, see: malwaretech.com/2024/02/bypassing-edrs-with-edr-preload.html...

Payload-Download-Cradles

Payload Download Cradles This are different types of download cradles which should be an inspiration to play and create new download cradles to bypass AV/EPP/EDR in context of download cradle detections. Notice, removing or obfuscating signatures from your download cradle is only one piece of the...

NTDLLReflection

NTDLLReflection Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle to ntdll , and trigger exported APIs from the export table...

UnhookingPatch

UnhookingPatch Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime image How do i convert binary to MAC ? Requirements: 1. macaddress pip install macaddress ./bin2mac.py calc.bin...

CVE-2026-36425

CVE-2026-36425 : OPSWAT AppRemover Arbitrary Process Termination A signed OPSWAT kernel driver that kills any process on demand. No admin rights needed, no privilege checks, no questions asked. Point it at an EDR, an antivirus, a PPL-protected process and it dies. Three different kill methods, al...

NTDLL-reconstruction

NTDLL-reconstruction A userland EDR bypass technique that allows you to flip between unhooked and hooked ntdll.dll at will. How I built this can be found here. Usage You can just drag and drop the .h and .c file into your project make sure you edit the header file definition for CRT functions tha...

EtwSessionHijacking

EtwSessionHijacking: A Poc on blocking Procmon from monitoring network events Demo: https://user-images.githubusercontent.com/111295429/186082150-32ed304b-ba45-42a4-8baa-37dd75246c68.mp4 Based On : Design Issues Of Modern EDRs: Bypassing ETW-Based Solutions...