Popular repositoriesLoading

1. DEFCON-31-Syscalls-WorkshopDEFCON-31-Syscalls-WorkshopPublic

   Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

   C 653 94

2. Payload-Download-CradlesPayload-Download-CradlesPublic

   This are different types of download cradles which should be an inspiration to play and create new download cradles to bypass AV/EPP/EDR in context of download cradle detections.

   PowerShell 257 51

3. Create-Thread-Shellcode-FetcherCreate-Thread-Shellcode-FetcherPublic

   This POC gives you the possibility to compile a .exe to completely avoid statically detection by AV/EPP/EDR of your C2-shellcode and download and execute your C2-shellcode which is hosted on your (…

   C++ 246 50

4. Direct-Syscalls-vs-Indirect-SyscallsDirect-Syscalls-vs-Indirect-SyscallsPublic

   The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

   C 179 23

5. Direct-Syscalls-A-journey-from-high-to-lowDirect-Syscalls-A-journey-from-high-to-lowPublic

   Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

   C 133 22

6. Taskschedule-Persistence-Download-CradlesTaskschedule-Persistence-Download-CradlesPublic

   Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged

   HTML 86 22