From d3e9452b2aefa3760f8f9acde79da041acd5756e Mon Sep 17 00:00:00 2001
From: pe3zx <pe3zx@users.noreply.github.com>
Date: Wed, 9 Feb 2022 11:56:33 +0700
Subject: [PATCH] Add: ORCA666/snaploader to Defense Evasion section

---
 Offensive.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Offensive.md b/Offensive.md
index 35314f4..18bc976 100644
--- a/Offensive.md
+++ b/Offensive.md
@@ -1576,6 +1576,10 @@ Some tools can be categorized in more than one category. But because the current
         <td><a href="https://github.com/ORCA666/EVA3">ORCA666/EVA3</a></td>
         <td>using hellsgate in EVA to get the syscalls</td>
     </tr>
+    <tr>
+        <td><a href="https://gitlab.com/ORCA666/snaploader">ORCA666/snaploader</a></td>
+        <td>Injecting shellcode into 'ntdll.dll' address space in target process, and hijacking its thread without calling GetThreadContext, evading memory scanners, and more ...</td>
+    </tr>
     <tr>
         <td><a href="https://github.com/ORCA666/T.D.P">ORCA666/T.D.P</a></td>
         <td>Using Thread Description To Hide Shellcode</td>