sneakid Goto Github PK

pplrunner

Run Processes as PPL with ELAM

process-dump

Windows tool for dumping malware PE files from memory back to disk for analysis.

psbits

Simple (relatively) things allowing you to dig a bit deeper than usual.

psimagenotifyroutinespamfilter

PsImageNotifyRoutine Spam Filter

pteditor

A small library to modify all page-table levels of all processes from user space for x86_64 and ARMv8.

reinschauer

s-500-g2-rat-hvnc-hidden-broswers-hidden-apps-operagx-rat-remote-malware

Hidden VNC is technique used by most advanced users, and by fark the most exiciting way to manage your Computer System hidden without interacting with the main desktop at all, simply because it creates a new hidden desktop.

shellghost

A memory-based evasion technique which makes shellcode invisible from process start to end.

shellvm

A collection of LLVM transform and analysis passes to write shellcode in regular C

silentmoonwalk

PoC Implementation of a TRUE call stack spoofer

simpleamsiprovider

A simple provider to analyse what gets passed into Microsoft's Anti-Malware Scan Interface

stealthy-kernelmode-injector

Manual mapper that uses PTE manipulation, Virtual Address Descriptor (VAD) manipulation, and forceful memory allocation to hide executable pages. (VAD hide / NX bit swapping)

strace

A DTrace on Windows Reimplementation

syskey

A simple NtUserGetAsyncKeyState wrapper

tamperingsyscalls

tangledwinexec

PoCs and tools for investigation of Windows process execution techniques

terminator

Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes

tinynuke

zeus-style banking trojan

truesightkiller

CPP AV/EDR Killer

unwinder

Another approach to thread stack spoofing.

veh-poc

venom

Venom is a library that meant to perform evasive communication using stolen browser socket

vx-api

Collection of various malicious functionality to aid in malware development

w3wprotect

W3WProtect is a PoC Driver that protects IIS from exploitation.

win2k

Windows 2000 source code

windows-classic-samples

This repo contains samples that demonstrate the API used in Windows classic desktop applications.

windows-driver-samples

This repo contains driver samples prepared for use with Microsoft Visual Studio and the Windows Driver Kit (WDK). It contains both Universal Windows Driver and desktop-only driver samples.

windows-kernel-explorer

A free but powerful Windows kernel research tool.

windows-kernel-process-protector

Protect a process from code injection, termination and hooking

windows-research-kernel-wrk-

Windows Research Kernel Source Code