Open-source alternatives to Vba Runpe

pefile is a Python module to read and work with PE (Portable Executable) files

SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader.

A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

PowerLessShell rely on MSBuild.exe to remotely execute PowerShell scripts and commands without spawning powershell.exe. You can also execute raw shellcode using the same approach.

Hide your Powershell script in plain sight. Bypass all Powershell security features

Run PowerShell with rundll32. Bypass software restrictions.

The Hunt for Malicious Strings

This repo contains some Amsi Bypass methods i found on different Blog Posts.

Donut is a toolset for loading and executing payloads in memory, featuring a position-independent shellcode generator, an in-memory payload injector, and a .NET assembly loader. It is designed to convert executable files and scripts into shellcode that can be executed within the memory space of a remote process without writing files to disk. The project specializes in security evasion through memory-based patching and payload obfuscation using symmetric block ciphers and compression. It includes a remote payload stager to retrieve encrypted modules from HTTP or DNS servers during runtime, red