
mora-hwbp
Hardware Breakpoint (DR0-DR7) based patch-less user-mode hooking & telemetry instrumentation engine (AMSI, WLDP & ETW PoC).

Hardware Breakpoint (DR0-DR7) based patch-less user-mode hooking & telemetry instrumentation engine (AMSI, WLDP & ETW PoC).

PoCs and tools for investigation of Windows process execution techniques

NimicStack is the pure Nim implementation of Call Stack Spoofing technique to mimic legitimate programs

Call stack spoofing for Rust

CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files (BOF) for Cobalt Strike to perform process injection,…

A tool to find folders excluded from AV real-time scanning using a time oracle

This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret gadget can…

Improved version of EKKO by @5pider that Encrypts only Image Sections

This repo contains C/C++ snippets that can be handy in specific offensive scenarios.

Attempt at Obfuscated version of SharpCollection

HyperDeceit is the ultimate all-in-one library that emulates Hyper-V for Windows, giving you the ability to intercept and manipulate operating system…

Detection rule validation

Performing Indirect Clean Syscalls

Windows 10 DLL Injector via Driver utilizing VAD and hiding the loaded driver

C++ self-Injecting dropper based on various EDR evasion techniques.

PoC demonstrating a multi process injection chain aimed at remotely executing shellcode

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

Leak NTLM via Website tab in teams via MS Office