Empire
bc-security/empireEncrypted C2 and post-exploitation framework for red teams, with modular PowerShell/Python/C#/Go agents, many offensive modules, and easy…
adversarial-attackcommand-and-controlids-ips-evasion+5
5.3k
bc-security/empireEncrypted C2 and post-exploitation framework for red teams, with modular PowerShell/Python/C#/Go agents, many offensive modules, and easy…
netero1010/edrsilencerA tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.
jm33-m0/emp3r0rSelf‑healing Gossip Mesh C2 with Assisted Peer Discovery, Cross-Platform BOF Execution, and Scriptable Agents.
denoland/clawpatrolWire-level proxy firewall for AI agents that intercepts and gates SQL, Kubernetes, and HTTP traffic using HCL rules, with per-process tunnel…
luckypipewrench/pipelockOpen-source AI agent firewall that scans HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, emitting verifiable…
senzee1984/edrprisonLeverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry
tiliondev/fortressStealth Chromium engine that stops scrapers and browser agents from getting blocked, with one line of code change.
0xtriboulet/revenantRevenant - A 3rd party agent for Havoc that demonstrates evasion techniques in the context of a C2 framework
matheuzsecurity/ringreaperLinux post-exploitation agent that uses io_uring to stealthily bypass EDR detection by avoiding traditional syscalls.
twosevenonet/edrchokerA tool uses the QoS Policy (Pacer.sys) to throttle Endpoint Detection and Response (EDR) agents from connecting to the server.
nullsection/chisel-ngChisel new generation, written in rust. SSH under WSS with some customization.
borenstein/yolo-cageAI coding agents that can't exfiltrate secrets or merge their own PRs.
swelljoe/flarLightweight CLI tool that runs AI coding agents inside isolated Bubblewrap sandboxes with strict filesystem, network, and credential isolation to…
nccgroup/shouganaiyo-loadershouganaiyo-loader is a cross-platform Frida-based Node.js command-line tool that forces Java processes to load a Java/JVMTI agent regardless of…
ig-labs/edr-alpc-block-pocBlocking Windows EDR agents by registering an own IPC-object in the Object Manager’s namespace (CVE-2023-3280, CVE-2024-5909, CVE-2024-20671)
c0oki3s/veilgateAsymmetric defense against adversarial AI agents. VeilGate evaluates each incoming request, redirects suspected agents into a per-IP-consistent…
