Beast code in Giters

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

Language:CBSD-2-Clause193200

Pentest-Windows

Windows11 Penetration Suite Toolkit 一个开箱即用的windows渗透测试环境

171000

yara

The pattern matching swiss knife

Language:CBSD-3-Clause786700

ThreatCheck

Identifies the bytes that Microsoft Defender / AMSI Consumer flags on.

Language:C#95400

process_overwriting

Yet another variant of Process Hollowing

Language:C++34400

pe_to_shellcode

Converts PE into a shellcode

Language:C++BSD-2-Clause225600

Hunt-Sleeping-Beacons

Aims to identify sleeping beacons

Language:C41900

BeaconEye

Hunts out CobaltStrike beacons and logs operator command output

Language:C#84200

Malleable-CS-Profiles

A list of python tools to help create an OPSEC-safe Cobalt Strike profile.

Language:YARA32800

darkPulse

darkPulse是一个用go编写的shellcode Packer，用于生成各种各样的shellcode loader，免杀火绒，360核晶等国内常见杀软。

Language:Go55600

AlternativeShellcodeExec

Alternative Shellcode Execution Via Callbacks

Language:C++MIT135400

ChangeTimestamp

一键修改exe、dll的编译时间、创建时间、修改时间和访问时间

Language:C#MIT15700

FUD-UUID-Shellcode

Language:C++32000

malleable-c2

Cobalt Strike Malleable C2 Design and Reference Guide

GPL-3.0152100

AheadLibEx

hijack dll Source Code Generator .

Language:C++GPL-3.013800

RWX_MEMEORY_HUNT_AND_INJECTION_DV

Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.

Language:C++MIT17900

tmp_file

解决先知文件大小限制的问题

Language:C++1200

No_X_Memory_ShellCode_Loader

无可执行权限加载 ShellCode。Loading ShellCode without executable permission.

Language:C++18500

RingQ

一款后渗透免杀工具，助力每一位像我这样的脚本小子快速实现免杀，支持bypass AV/EDR 360 火绒 Windows Defender Shellcode Loader

Language:C++60100