CustomC2ChannelTemplate

IAT Hooking for custom C2 channels This is a simple PoC and template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader. Blog post: https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/building-custom-c2-channels-by-hooking-winin...

BOF_RunPe

BOFRunPE BOF RunPE es un archivo de objeto Beacon BOF para Cobalt Strike que ejecuta archivos PE completamente en memoria dentro del proceso del beacon. A diferencia del tradicional fork&run, no se crea ningún proceso hijo, no se crea ninguna consola y no se utiliza ninguna tubería pipe ; toda la...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

libpeconv

libPeConv مكتبة لتحميل ملفات PE والتعامل معها. الأهداف كان الهدف من libPeConv هو إنشاء «سكين الجيش السويسري» للتحميل المخصص لملفات PE. يجمع دوالًا مساعدة متنوعة يمكنك دمجها بسرعة في المحمّل الخاص بك. على سبيل المثال: إعادة تعيين الأقسام، تطبيق عمليات إعادة التوطين، تحميل الواردات، تحليل الموارد. ...

hookchain

Hookchain Abstract - EN In the current digital security ecosystem, where threats evolve rapidly and with complexity, companies developing Endpoint Detection and Response EDR solutions are in constant search for innovations that not only keep up but also anticipate emerging attack vectors. In this...

NtDetours

NTSTATUS NTAPI TrInitPVOID ImageBase = &ImageBase; make IAT writable. look for simple.cpp TimedSleepEx calls the real SleepEx API through the TrueSleepEx function pointer. root@kitploit: static DWORD WINAPI TrueSleepExDWORD dwMilliseconds, BOOL bAlertable = SleepEx; DWORD WINAPI TimedSleepExDWORD...

BestEdrOfTheMarket - Little AV/EDR Bypassing Lab For Training And Learning Purposes

Little AV/EDR Evasion Lab for training & learning purposes. ️ under construction..​ | | | | | | \ / \ / | | | | | \ / / | | | | | | | | | | | | | | | | | | ' \ / \ | | | /\ \ | | || || | | || | | | | | | | | / |/||/| ||/|| \ /|| || || ||| | / | | | | | | |/| |/ | '| |/ / \ | | | | | | | |...