How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging.
LoadLibrary for offensive operations
C# Based Universal API Unhooker - Automatically Unhook API Hives (ntdll.dll, kernel32.dll, advapi32.dll, and kernelbase.dll). SharpUnhooker helps you to evades user-land monitoring done by AVs and/or EDRs by cleansing/refreshing API DLLs that loaded on the process (Offensive Side) or remove API…
Have these local admin credentials but the EDR is standing in the way? Unhooking or direct syscalls are not working against the EDR? Well, why not just kill it? Backstab is a tool capable of killing antimalware protected processes by leveraging sysinternals’ Process Explorer (ProcExp) driver,…
The main features of yaxser/backstab are: Defense Evasion, EDR and Logging Evasion, Evasion Tooling.
Open-source alternatives to yaxser/backstab include: netero1010/edrsilencer — Inspired by the closed source FireBlock tool FireBlock from MdSec NightHawk, I decided to create my own version and… getrektboy724/sharpunhooker — C# Based Universal API Unhooker - Automatically Unhook API Hives (ntdll.dll, kernel32.dll, advapi32.dll, and… bats3c/darkloadlibrary — LoadLibrary for offensive operations. bats3c/evtmute — This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event… ccob/sharpblock. soledge/blocketw — .Net 3.5 / 4.5 Assembly to block ETW telemetry in a process.
