Veil 3.1.X (Check version info in Veil at runtime)

Python antivirus evasion tool

Identifies the bytes that Microsoft Defender flags on.

A fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.

An Python Script For Generating Payloads that Bypasses All Antivirus so far .

Cloak can backdoor any python script with some tricks.

InviZzzible is a tool for assessment of your virtual environments in an easy and reliable way. It contains the most recent and up to date detection and evasion techniques as well as fixes for them.

A curated list of awesome Windows frameworks, libraries, software and resources for Red Teams

C# code for Transferring Backdoor Payloads by DNS Traffic and Bypassing Anti-viruses

Enumerate and disable common sources of telemetry used by AV/EDR.

Zombie Ant Farm: Primitives and Offensive Tooling for Linux EDR evasion.

Neutering Sysmon via driver unload

Green-hat-suite is a tool to generate meterpreter/shell which could evade antivirus.

Undetectable & Xor encrypting with custom KEY (FUD Metasploit Rat) bypass Top Antivirus like BitDefender,Malwarebytes,Avast,ESET-NOD32,AVG,... & Automatically Add ICON and MANIFEST to excitable

IPv4 and IPv6 address rate limiting evasion tool

Unprotect is a python tool for parsing PE malware and extract evasion techniques.

Fragscapy is a command-line tool to fuzz network protocols by automating the modification of outgoing network packets. It can run multiple successive tests to determine which options can be used to evade firewalls and IDS.

C# code for Transferring Backdoor Payloads by ARP Traffic and Bypassing Anti-viruses (Slow)

Packer (actually a crypter) for antivirus evasion implemented for windows PE files (BSc-Thesis)

Final project for the M.Sc. in Engineering in Computer Science at Università degli Studi di Roma "La Sapienza" (A.Y. 2016/2017).

Detect virtual environment

A summary about different projects/presentations/tools to test how to evade malware sandbox systems

A PERSISTENT FUD Backdoor ReverseShell coded in C for any Windows distro, that will make itself persistent on every BOOT and fire a decoy app in the foreground while connecting back to the attacker machine as a silent background process , spawning a POWERSHELL on the attacker machine.

Random IPv6 - circumvents restrictive IP address-based filter and blocking rules

Launch a Windows EXE file with this EXE file (application filter evasion)

execute a PE in the address space of another PE aka process hollowing

Windows (ShadowMove) Socket Duplication

512-bit block encryption algorithm, specially for x64

Penetration Testing Stack

PS1 script to clear Windows Event Log without wevtutil or Clear-EventLog