Red team engagement help!

• ScareCrow

  11 2,552 0.0 Go

  Discontinued ScareCrow - Payload creation framework designed around EDR bypass.

  

• Freeze

  8 1,317 5.0 Go

  Discontinued Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods (by optiv)

  

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• Limelighter

  4 843 0.0 Go

  A tool for generating fake code signing certificates or signing real ones

Use lime lighter to fake code sign for better static detection evasion https://github.com/Tylous/Limelighter

• SigThief

  2 1,943 10.0 Python

  Stealing Signatures and Making One Invalid Signature at a Time

I think this is also similar to this https://github.com/secretsquirrel/SigThief

• EDRs

  7 1,889 0.0 C

As for the shellcode. Just encrypt the shellcode and use some form of injection like QueueUserAPC injection. If the EDR does usermode hooking, remap NTDLL and Kernel32 first, if it’s kernel mode only (MDE for example) just patch either the Win32 API ETWEventWrite or NT api NTEventTrace with a ret (0x3c on 64 bit x86) an example is here https://github.com/Mr-Un1k0d3r/EDRs/blob/main/unhook_bof.c

• AceLdr

  2 806 2.8 C

  Cobalt Strike UDRL for memory scanner evasion.

But I do always healthy recommend writing a custom DLL loader for your payloads. And with CS, make sure you’re using a custom reflective loader. Something like AceLDR https://github.com/kyleavery/AceLdr

• NSGenCS

  2 134 0.0 Python

  Extendable payload obfuscation and delivery framework

Never failed to get execution on target using this https://github.com/t3hbb/NSGenCS

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• CarbonCopy

  3 1,245 0.0 Python

  A tool which creates a spoofed certificate of any online website and signs an Executable for AV Evasion. Works for both Windows and Linux

Funny enough, I've had some luck with fake-signing exes. https://github.com/paranoidninja/CarbonCopy Its a little old so your milage might vary (I honestly havent used it in a year or so) but in a pinch I've fake signed with microsoft.com public cert and it bypassed av and edr tools.

Suggest a related project