awesome-repositories.com
Blog
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectAboutHow we rankPressMCP server
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
·
Back to cerbersec/killdefenderbof

Open-source alternatives to KillDefenderBOF

30 open-source projects similar to cerbersec/killdefenderbof, ranked by how many features they have in common. Compare stars, activity and what each one does to find the best KillDefenderBOF alternative.

  • lolbas-project/lolbasLOLBAS-Project avatar

    LOLBAS-Project/LOLBAS

    8,323View on GitHub↗

    LOLBAS is a curated database and knowledge base of signed Windows binaries that can be misused to bypass security restrictions and execute unauthorized code. It serves as a technical registry that maps trusted system files to their functional capabilities and the offensive tactics they enable. The project distinguishes itself by providing a capability-driven indexing system and a tactics registry that relates legitimate binary functionality to known security evasion techniques. It includes an association layer that links specific system binaries to attack patterns and tactical objectives, pro

    XSLTblueteamdfirliving-off-the-land
    View on GitHub↗8,323
  • api0cradle/ultimateapplockerbypasslistapi0cradle avatar

    api0cradle/UltimateAppLockerByPassList

    2,067View on GitHub↗

    The goal of this repository is to document the most common techniques to bypass AppLocker.

    PowerShell
    View on GitHub↗2,067
  • aptortellini/undefenderAPTortellini avatar

    APTortellini/unDefender

    360View on GitHub↗

    unDefender is the C++ implementation of a technique originally described by @jonasLyk in this Twitter thread. At its core, this technique revolves around changing the \Device\BootDevice symbolic link in the Windows Object Manager so that when Defender's WdFilter driver is unloaded and loaded…

    C++
    View on GitHub↗360
  • bats3c/darkloadlibrarybats3c avatar

    bats3c/DarkLoadLibrary

    1,180View on GitHub↗

    LoadLibrary for offensive operations

    C
    View on GitHub↗1,180

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Find more with AI search
  • bats3c/evtmutebats3c avatar

    bats3c/EvtMute

    264View on GitHub↗

    This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging.

    C#
    View on GitHub↗264
  • ccob/sharpblockCCob avatar

    CCob/SharpBlock

    1,163View on GitHub↗
    C#
    View on GitHub↗1,163
  • flangvik/netloaderFlangvik avatar

    Flangvik/NetLoader

    849View on GitHub↗

    Loads any C# binary from filepath or url, patching AMSI and unhooks ETW

    C#
    View on GitHub↗849
  • fuzzysecurity/sharp-suiteFuzzySecurity avatar

    FuzzySecurity/Sharp-Suite

    1,142View on GitHub↗

    Also known by Microsoft as Knifecoat :hot_pepper:

    C#
    View on GitHub↗1,142
  • getrektboy724/sharpunhookerGetRektBoy724 avatar

    GetRektBoy724/SharpUnhooker

    408View on GitHub↗

    C# Based Universal API Unhooker - Automatically Unhook API Hives (ntdll.dll, kernel32.dll, advapi32.dll, and kernelbase.dll). SharpUnhooker helps you to evades user-land monitoring done by AVs and/or EDRs by cleansing/refreshing API DLLs that loaded on the process (Offensive Side) or remove API…

    C#
    View on GitHub↗408
  • hlldz/invoke-phant0mH

    hlldz/Invoke-Phant0m

    0View on GitHub↗
    View on GitHub↗0
  • hlldz/phant0mhlldz avatar

    hlldz/Phant0m

    1,807View on GitHub↗

    Svchost is essential in the implementation of so-called shared service processes, where a number of services can share a process in order to reduce resource consumption. Grouping multiple services into a single process conserves computing resources, and this consideration was of particular…

    C
    View on GitHub↗1,807
  • hlldz/reflexxionhlldz avatar

    hlldz/RefleXXion

    500View on GitHub↗

    RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first collects the syscall numbers of the NtOpenFile, NtCreateSection, NtOpenSection and NtMapViewOfSection found in the LdrpThunkSignature array. After…

    C++
    View on GitHub↗500
  • kharos102/ntdllunpatcherKharos102 avatar

    Kharos102/NtdllUnpatcher

    151View on GitHub↗

    Example code for EDR bypassing, please use this for testing blue team detection capabilities against this type of malware that will bypass EDR's userland hooks. Code is a bit spaghetti-like at the moment and serves only as a PoC. Not for malicious use. Note that this particular code was tested…

    C++
    View on GitHub↗151
  • kyleavery/aceldrkyleavery avatar

    kyleavery/AceLdr

    1,020View on GitHub↗

    A position-independent reflective loader for Cobalt Strike. Zero results from Hunt-Sleeping-Beacons, BeaconHunter, BeaconEye, Patriot, Moneta, PE-sieve, or MalMemDetect.

    C
    View on GitHub↗1,020
  • lem0nsec/shellghostlem0nSec avatar

    lem0nSec/ShellGhost

    1,199View on GitHub↗

    A memory-based evasion technique which makes shellcode invisible from process start to end.

    C
    View on GitHub↗1,199
  • mattifestation/ef0132ba4ae3cc136914da32a88106b9M

    mattifestation/ef0132ba4ae3cc136914da32a88106b9

    0View on GitHub↗
    View on GitHub↗0
  • mdsecactivebreach/firewalkermdsecactivebreach avatar

    mdsecactivebreach/firewalker

    154View on GitHub↗

    This repo contains a simple library which can be used to add FireWalker hook bypass capabilities to existing code; the FireWalker concept is described on the MDSec blog at https://www.mdsec.co.uk/2020/08/firewalker-a-new-approach-to-generically-bypass-user-space-edr-hooking/.

    C
    View on GitHub↗154
  • med0x2e/sigflipmed0x2e avatar

    med0x2e/SigFlip

    1,283View on GitHub↗

    SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

    C#
    View on GitHub↗1,283
  • mkorman90/sysmon-config-bypass-finderM

    mkorman90/sysmon-config-bypass-finder

    0View on GitHub↗
    View on GitHub↗0
  • mortenson/pr-sneakingmortenson avatar

    mortenson/pr-sneaking

    11View on GitHub↗

    This repository exists to demonstrate methods of sneaking malicious code into Github pull requests.

    CSS
    View on GitHub↗11
  • mufeedvh/moonwalkmufeedvh avatar

    mufeedvh/moonwalk

    1,485View on GitHub↗

    Cover your tracks during Linux Exploitation/Penetration Testing by leaving zero traces on system logs and filesystem timestamps.

    Rust
    View on GitHub↗1,485
  • netero1010/edrsilencernetero1010 avatar

    netero1010/EDRSilencer

    1,883View on GitHub↗

    Inspired by the closed source FireBlock tool FireBlock from MdSec NightHawk, I decided to create my own version and this tool was created with the aim of blocking the outbound traffic of running EDR processes using Windows Filtering Platform (WFP) APIs.

    C
    View on GitHub↗1,883
  • nul0x4c/atomldrN

    NUL0x4C/AtomLdr

    0View on GitHub↗
    View on GitHub↗0
  • octoberfest7/inline-execute-peOctoberfest7 avatar

    Octoberfest7/Inline-Execute-PE

    724View on GitHub↗

    Inline-Execute-PE is a suite of Beacon Object Files (BOF's) and an accompanying Aggressor script for CobaltStrike that enables Operators to load unmanaged Windows executables into Beacon memory and execute them, retrieving the output and rendering it in the Beacon console.

    C
    View on GitHub↗724
  • omerya/invisi-shellOmerYa avatar

    OmerYa/Invisi-Shell

    1,327View on GitHub↗

    Hide your Powershell script in plain sight. Bypass all Powershell security features

    C++
    View on GitHub↗1,327
  • optiv/mangleoptiv avatar

    optiv/Mangle

    1,236View on GitHub↗

    To view the latest version of Mangle or to submit an issue, reference https://github.com/Tylous/Mangle.

    Go
    View on GitHub↗1,236
  • optiv/scarecrowoptiv avatar

    optiv/ScareCrow

    2,888View on GitHub↗

    To view the latest version of ScareCrow or to submit an issue, reference https://github.com/Tylous/ScareCrow.

    Go
    View on GitHub↗2,888
  • outflanknl/findobjects-bofoutflanknl avatar

    outflanknl/FindObjects-BOF

    274View on GitHub↗

    This repository has been moved to our C2-Tool-Collection repository.

    View on GitHub↗274
  • secretsquirrel/sigthiefsecretsquirrel avatar

    secretsquirrel/SigThief

    2,372View on GitHub↗
    Pythoncertificatespepython
    View on GitHub↗2,372
  • soledge/blocketwSoledge avatar

    Soledge/BlockEtw

    81View on GitHub↗

    .Net 3.5 / 4.5 Assembly to block ETW telemetry in a process

    C#
    View on GitHub↗81