Bypass the Event Trace Windows(ETW) and unhook ntdll.
-
Updated
Sep 29, 2023 - C
#
etw-evasion
Here are 7 public repositories matching this topic...
Two in one, patch lifetime powershell console, no more etw and amsi!
-
Updated
Jun 27, 2024 - Go
A WIP shellcode loader tool which bypasses AV/EDR, coded in C++, and equipped with a minimal console builder.
obfuscation powershell persistence malware shellcode evasion pe-loader bypass-antivirus crypter shellcode-loader payload-generator xor-encryption redteam shellcode-encoder edr-bypass etw-evasion etw-bypass
-
Updated
Sep 1, 2024 - C++
Event Tracing for Windows EDR bypass in Rust
rust malware hacking pentesting etw malware-research pentest ethical-hacking red-team pentest-tool redteaming redteam edr ethical-hacking-tools redteam-tools edr-bypass edr-evasion etw-evasion etw-bypass
-
Updated
Jun 9, 2024 - Rust
code snippet provided demonstrates how to patch the EtwEventWrite function in the ntdll.dll library on Windows using CGO (C Go).
-
Updated
Jun 27, 2024 - Go
Loads a C# binary in memory within powershell profile, patching AMSI + ETW.
nim powershell etw offensive-security fud red-teaming pentesting-tools amsi-bypass amsi-evasion etw-evasion amsi-patch etw-bypass offensivenim
-
Updated
Jun 27, 2024 - Nim
Bypassing Event Tracing for Windows (ETW) with CSharp
-
Updated
Jul 20, 2023 - C++
Improve this page
Add a description, image, and links to the etw-evasion topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the etw-evasion topic, visit your repo's landing page and select "manage topics."