drcyb3rr Goto Github PK

acheron

indirect syscalls for AV/EDR evasion in Go assembly

active-directory-exploitation-cheat-sheet

A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

adcshunter

Uses rpcdump to locate the ADCS server, and identify if ESC8 is vulnerable from unauthenticated perspective.

amsi-bypass

ansible

apcldr

Payload Loader With Evasion Features

atlasldr

Reflective x64 PE/DLL Loader implemented using Dynamic Indirect Syscalls

awesome-av-edr-xdr-bypass

Awesome AV/EDR/XDR Bypass Tips

awesome-red-team-operations

badzure

BadZure orchestrates the setup of Azure Active Directory tenants, populating them with diverse entities while also introducing common security misconfigurations to create vulnerable tenants with multiple attack paths.

beginners-guide-to-obfuscation

better-sliver

Adversary Emulation Framework

blackout

kill anti-malware protected processes (BYOVD)

bobthesmuggler

"Bob the Smuggler": A tool that leverages HTML Smuggling Attack and allows you to create HTML files with embedded 7z/zip archives. The tool would compress your binary (EXE/DLL) into 7z/zip file format, then XOR encrypt the archive and then hides inside PNG/GIF image file format (Image Polyglots).

bypassav

Documentation about how to bypass AMSI or AV.

callstackspoofingpoc

C++ self-Injecting dropper based on various EDR evasion techniques.

cheesetools

Self-developed tools for Lateral Movement/Code Execution

chimera

Automated DLL Sideloading Tool With EDR Evasion Capabilities

cloudpentestcheatsheets

This repository contains a collection of cheatsheets I have put together for tools related to pentesting organizations that leverage cloud providers.

cobaltstrike_redteam_cheatsheet

Useful Cobalt Strike techniques learned from engagements

coercedpotatordll

Reflective DLL to privesc from NT Service to SYSTEM using SeImpersonateToken privilege

condor

「🛡️」AVs/EDRs Evasion tool

darkside

C# AV/EDR Killer using less-known driver (BYOVD)

darkwidow

Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+BlockDll) mitigation policy on spawned process + PPID spoofing + Api resolving from TIB + API hashing

dkmc

DKMC - Dont kill my cat - Malicious payload evasion tool

dll4shell

Shellcode launcher for AV bypass

ebook-bypassingavsbycsharp

eBook "Bypassing AVS by C#.NET Programming" (Free Chapters only)

edrception

A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.

edrsilencer

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

espio

Shellcode obfuscation tool to avoid AV/EDR.