libprocesshider
gianlucaborello/libprocesshiderLD_PRELOAD shared library that hides a Linux process from tools like ps and lsof by intercepting readdir and proc filesystem calls.
defensive-toolsinformation-gatheringmalware-analysis+4
gianlucaborello/libprocesshiderLD_PRELOAD shared library that hides a Linux process from tools like ps and lsof by intercepting readdir and proc filesystem calls.
fkie-cad/sandroid_dexray-interceptA Android malware analysis tool that creates comprehensive runtime profiles by hooking into application behavior across cryptography, file systems,…
atomdrift-project/scan0-day malware detection for binaries, source & scripts (that doesn't suck)
gmh5225/evilkasperskyWindows kernel driver experiment based on KasperskyHook that uses direct syscalls for interprocess memory copying, with support for unloading the…
gmh5225/fakeenclaveProof-of-concept that abuses Windows Enclave to implement anti-tamper and anti-cheat evasion techniques at the driver level.
amd2g2zz/kunglao-agentThe reverse-engineering expert agent: plans its own analysis path, derives every fact from raw evidence, and converges under mechanical verification…
badchars/darknet-mcp-server66-tool MCP server for dark web intelligence — breach data, ransomware tracking, Tor .onion access, malware analysis, blockchain intel, exploit…
gmh5225/driver-hidekernelthread-iocancelirpWindows kernel driver technique that hides kernel threads by abusing IoCancelIrp and IRP cancel routines, with detection methods for identifying…
svdwi/blueboxOpen-source threat intelligence platform for malware and observable analysis. Enriches IPs, domains, URLs, and hashes with external sources, performs…
jithinkrishnanrs/stylesmuggler-ioc-toolkitStyleSmuggler (CVE-2026-75650) IOC toolkit for Magento Open Source and Adobe Commerce. Detect compromised stores, Rust implants, PHP web shells,…
ghostwolflab/apt-individual-combat-guideEducational guide and code repository for understanding APT attack techniques, covering reconnaissance, web and service exploitation, trojans, C2,…
hasherezade/jsc_deobfuscatorStatic deobfuscation toolkit for compiled V8 JavaScript bytecode, focusing on JSCeal payloads. Provides pattern-driven filters, control-flow…
machine1337/pyobfuscateA simple and efficent script to obfuscate python payloads to make it completely FUD
withsecurelabs/modulestompingResearch and proof-of-concept for module stomping, a technique to hide malicious code in legitimate Windows modules, with documentation and…
withsecurelabs/amsidetectionProof-of-concept tool for detecting AMSI (Antimalware Scan Interface) bypasses and malicious in-memory script activity on Windows endpoints.
withsecurelabs/shadowhammerBatch-mode checker for Shadowhammer malware indicators, scanning local or provided MAC addresses against known malicious hashes, with offline support…
withsecurelabs/doublepulsar-usermode-injectorA utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use in testing…
hackpatato/cve-2026-33057---mesop-unauthenticated-rce-poc-and-yara-rulesProof-of-concept exploit for CVE-2026-33057, an unauthenticated RCE in Mesop, with accompanying YARA rules for detection.