diff --git a/Offensive.md b/Offensive.md index 079a842..6210f50 100644 --- a/Offensive.md +++ b/Offensive.md @@ -1331,10 +1331,18 @@ Some tools can be categorized in more than one category. But because the current med0x2e/SigFlip SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature. + + mgeeky/ShellcodeFluctuation + An in-memory evasion technique fluctuating shellcode memory protection between RW & RX and encrypting/decrypting contents + mgeeky/Stracciatella OpSec-safe Powershell runspace from within C# (aka SharpPick) with AMSI, Constrained Language Mode and Script Block Logging disabled at startup + + mgeeky/ThreadStackSpoofer + Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners and analysts. + MinervaLabsResearch/CoffeeShot CoffeeShot: Avoid Detection with Memory Injection @@ -1419,7 +1427,6 @@ Some tools can be categorized in more than one category. But because the current secretsquirrel/SigThief Stealing Signatures and Making One Invalid Signature at a Time - sinfulz/JustEvadeBro JustEvadeBro, a cheat sheet which will aid you through AMSI/AV evasion & bypasses. diff --git a/README.md b/README.md index a508e2e..42c0448 100644 --- a/README.md +++ b/README.md @@ -1965,6 +1965,10 @@ This repository is created as an online bookmark for useful links, resources and DoctorWebLtd/malware-iocs This repository contains Indicators of Compromise (IOCs) related to our investigations. + + Dragonfly + An automated sandbox to emulate and analyze malware + droidefense/engine Droidefense: Advance Android Malware Analysis Framework