Pinned Loading

1. DarkWidow DarkWidow Public

   Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+Bloc…

   C 610 81

2. SharpGmailC2 SharpGmailC2 Public

   Our Friendly Gmail will act as Server and implant will exfiltrate data via smtp and will read commands from C2 (Gmail) via imap protocol

   C# 258 46

3. reveng_rtkit reveng_rtkit Public

   Linux Loadable Kernel Module (LKM) based rootkit (ring-0), capable of hiding itself, processes/implants, rmmod proof, has ability to bypass infamous rkhunter antirootkit.

   C 240 52

4. ReflectiveNtdll ReflectiveNtdll Public

   A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via System…

   C 169 23

5. AMSI-patches-learned-till-now AMSI-patches-learned-till-now Public

   I have documented all of the AMSI patches that I learned till now

   C++ 68 11

6. Learning-EDR-and-EDR_Evasion Learning-EDR-and-EDR_Evasion Public

   I will be uploading all the codes which I created with the help either opensource projects or blogs. This is a step by step EDR learning path for me.

   C++ 267 31