Cracked5pider/Ekko

Sleep Obfuscation

842

12 commits

updated Dec 3, 2023

See the code

README

Ekko

A small sleep obfuscation technique that uses CreateTimerQueueTimer Win32 API.
Proof of Concept. Can be done better.

NOTE

This implementation has known flawes.
So I wouldn't recommend using it without knowing how it works or know how to spot and fix those flaws.
TLDR: don't copy and past it into your implants.

Credit

Austin Hudson (@SecIdiot) https://suspicious.actor/2022/05/05/mdsec-nighthawk-study.html
Originally discovered by Peter Winter-Smith and used in MDSec’s Nighthawk

Contributors

Cracked5pider

7 commits

adamsvoboda

4 commits

timwhitez

1 commits

Similar repos

tkmru/awesome-edr-bypass

Awesome EDR Bypass Resources For Ethical Hacking

1,588

hseoa/zakynthos-navagio-rootkit

PoC for PUBG's anti-cheat Zakynthos's rootkit navagio.sys

WithSecureLabs/CallStackSpoofer

A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a…

598

klezVirus/SilentMoonwalk

PoC Implementation of a fully dynamic call stack spoofer

997

S3cur3Th1sSh1t/Amsi-Bypass-Powershell

This repo contains some Amsi Bypass methods i found on different Blog Posts.

2,196

MSNightmare/HardBreacher

Kaspersky Antivirus For Endpoint ZeroDay Elevation of Privileges Vulnerability

286

knight0x07/ImpulsiveDLLHijack

C# based tool which automates the process of discovering and exploiting DLL Hijacks in target…

556

klezVirus/SysWhispers3

SysWhispers on Steroids - AV/EDR evasion via direct system calls.

1,667

Languages

90.8%

Makefile

9.2%