Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...

A POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and remote processes.

Remote Shellcode Injector

Documents Exfiltration project for fun and educational purposes

通过C/C++实现的 Windows RID Hijacking persistence technique (RID劫持 影子账户 账户克隆).

A POC of the ContainYourself research presented in DEF CON 31, which abuses the Windows containers framework to bypass EDRs.

Signtool for expired certificates

Windows x64 kernel mode rootkit process hollowing POC.

elevate to SYSTEM any way we can!

Bypass Malware Sandbox Evasion Ram check

Local privilege escalation PoC exploit for CVE-2019-16098