
Bypass-Sandbox-Evasion
C++ tool that patches Windows API calls to bypass sandbox RAM size checks, enabling malware to evade detection in isolated analysis environments.

C++ tool that patches Windows API calls to bypass sandbox RAM size checks, enabling malware to evade detection in isolated analysis environments.

BYOVD: Use 360 WFP driver to block EDR/XDR network connection.

Dynamically invoke arbitrary unmanaged code

HyperDeceit is the ultimate all-in-one library that emulates Hyper-V for Windows, giving you the ability to intercept and manipulate operating system…

A tool to detect and crash Cuckoo Sandbox

Patching ROP-encoded shellcodes into PEs

Nim Library for Offensive Security Development

Randomly changes Win32/64 PE Files for 'safer' uploading to malware and sandbox sites.

Userland exec PoC to be used as attack vector technique

Platform independent peCloak fork based on Capstone

Linux process identity cloaking tool that spoofs comm, argv, cmdline, environ, exe path, and VMAs via an 11-phase prctl pipeline to impersonate…

In-memory Mach-O dylib loader for stock macOS Python; decrypts, maps, and runs payloads without dlopen or writing to disk, with optional encrypted…

It encrypts the text section and set the protection to NO_ACCESS.

Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package. Windows ONLY.

Kernel-mode Windows driver for real-time detection of process injection techniques, including shellcode, DLL, and reflective injection, with syscall…

Detection reverse shell and kill it before trying shell.

Linux Kernel Runtime Integrity with eBPF

A Zeek ELF File Analyzer