How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first collects the syscall numbers of the NtOpenFile, NtCreateSection, NtOpenSection and NtMapViewOfSection found in the LdrpThunkSignature array. After…
unDefender is the C++ implementation of a technique originally described by @jonasLyk in this Twitter thread. At its core, this technique revolves around changing the \Device\BootDevice symbolic link in the Windows Object Manager so that when Defender's WdFilter driver is unloaded and loaded…
SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.
Hide your Powershell script in plain sight. Bypass all Powershell security features
The main features of omerya/invisi-shell are: AMSI and Restriction Bypass, Defense Evasion, Offensive Security Tools.
Projects with overlapping indexed features include: med0x2e/sigflip — SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the… rythmstick/amsitrigger — The Hunt for Malicious Strings. aptortellini/undefender — unDefender is the C++ implementation of a technique originally described by @jonasLyk in this Twitter thread. At its… hlldz/reflexxion — RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass… med0x2e/noamci. skerkour/black-hat-rust — This project is an offensive security toolkit and development framework for creating memory-safe malware, network…