
DutchOven
Application-scoped Windows network brownouts in native C and BOF form

Application-scoped Windows network brownouts in native C and BOF form

Spawns macOS programs through launchd's private XPC interface without execing them, making EDR record launchd as parent. Supports one-shot,…

Performing Indirect Clean Syscalls

NimicStack is the pure Nim implementation of Call Stack Spoofing technique to mimic legitimate programs

Crystal Palace library for proxying Nt API calls via the Threadpool. Updated for call gadgets.

Crystal Palace library for proxying Nt API calls via the Threadpool

Obex – Blocking unwanted DLLs in user mode

A Poc on blocking Procmon from monitoring network events

A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)

Call stack spoofing for Rust

HookChain: A new perspective for Bypassing EDR Solutions

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry

A slightly more fun way to disable windows defender + firewall. (through the WSC api)

Patch AMSI and ETW

C++ self-Injecting dropper based on various EDR evasion techniques.

PoC demonstrating a multi process injection chain aimed at remotely executing shellcode

Kernel-mode hook that intercepts, decrypts, and nullifies BEDaisy-to-service report traffic to suppress anti-cheat detection on UEFI and non-UEFI…