Cobalt Strike Beacon Object File for bypassing UAC via the CMSTPLUA COM interface.

EasyHook - The reinvention of Windows API Hooking

Proof of concept code for thread pool based process injection in Windows.

An EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer

一种通过进程注入实现强制关闭部分杀软进程的方法（以360安全卫士和360杀毒为例）

A command and control framework written in rust.

Reflective DLL Injection Made Bella

Reproducing Spyboy technique, which involves terminating all EDR/XDR/AVs processes by abusing the zam64.sys driver

一款集成了DLL-Session0注入，APC注入，映射注入，线程劫持，函数踩踏，提权的工具(支持BIN加解密)

VBS-Obfuscator-GO is a Go-based tool designed for obfuscating VBScript (VBS) files. It transforms readable VBScript code into a less recognizable form by employing random variable names and encodin…

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

A WIP shellcode loader tool which bypasses AV/EDR, coded in C++, and equipped with a minimal console builder.

C++ Staged Shellcode Loader with Evasion capabilities.

Collection of various malicious functionality to aid in malware development

C# Reflective loader for unmanaged binaries.

HookChain: A new perspective for Bypassing EDR Solutions

This GitHub repository contains benign specimens; however, the techniques demonstrated herein could potentially be exploited for malicious purposes. Exercise discretion and responsibility in their …

SysWhispers on Steroids - AV/EDR evasion via direct system calls.

C# PoC implementation for bypassing AMSI via in memory patching

Shellcode loader generator with multiples features

Implementing the ghostly hollowing PE injection technique using tampered syscalls.

This repository contains complete resources and coding practices for malware development using Rust 🦀.

A BOF that runs unmanaged PEs inline

Just a simple silly PoC demonstrating executable "exe" file that can be used like exe, dll or shellcode...

VM detection library and tool

Compiletime string literal obfuscation for Rust.

Now You See Me, Now You Don't

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

LSASS memory dumper using only NTAPIs, creating a minimal minidump. It can be compiled as shellcode (PIC), supports XOR encryption, and remote file transmission.