LifetimeAMSIBypass

• Bypassing AMSI (Antimalware Scan Interface).

misc

• Miscellaneous scripts and tools.

network

• Networking tools:
  • http (HTTP client and server)
  • pipes (Named pipes client and server)
  • tcp (TCP client and server)

ParentPIDSpoofing

• Techniques for spoofing parent process IDs.

PEParser

• Tools for parsing PE (Portable Executable) files.

process_dump

• Tools for dumping process memory.

ProtecProc

• Process protection techniques.

ProtectProcess

• Additional process protection techniques.

sandbox

• Techniques for detecting and evading sandboxes.

self_remove

• Tools for self-removing malware.

srdi

• Tools for shellcode reflection and dynamic invocation.

token

• Token manipulation tools:
  • impersonate
  • list

wmi

• Tools for interacting with Windows Management Instrumentation (WMI).

APC Injection

• Exploits the Asynchronous Procedure Call (APC) technique to execute malicious code within target processes.

Early Bird APC Injection

• A variation of APC Injection focusing on executing code before the main process starts.

Local Mapping Injection

• Demonstrates malicious code injection via memory mapping into local processes.

Local Payload Execution

• Addresses the direct execution of malicious payloads in a system's local environment.

Payload Execution Fibers

• Demonstrates running shellcode using Fibers, a type of lightweight thread.

Payload Placement

• Shows how to store shellcode in the .text section of a process and execute it.

Process Injection (Shellcode)

• Exploits shellcode injection directly into running processes to control or execute malicious tasks.

Registry Shellcode

• Demonstrates writing and reading shellcode to/from the Windows Registry.

Remote Function Stomping Injection

• Exploits the substitution of functions in remote systems to carry out malicious activities.

Remote Mapping Injection

• Demonstrates malicious code injection via memory mapping into remote processes.

Remote Thread Hijacking

• Focuses on hijacking threads in remote system processes to execute malicious code.

Threadless Injection

• Demonstrates threadless injection using Go & C, where shellcode is injected without creating a new thread.

RunPE (Run Portable Executable)

• Runs PE in Memory, PE = .exe.

Lifetime ETW - Amsi Bypass

• Patches Amsi and ETW forever in newly created powershell consoles.

Keylogger

• Logs keystrokes into a temp file.