Multilayered AV/EDR Evasion Framework (no longer actively maintained)
NyxInvoke is a Rust CLI tool for running .NET assemblies, PowerShell, and BOFs with Patchless AMSI and ETW bypass features. with Dual-build support
A WIP shellcode loader tool which bypasses AV/EDR, coded in C++, and equipped with a minimal builder.
Generator of https://github.com/TheWover/donut in pure Go. supports compression, AMSI/WLDP/ETW bypass, etc.
Advanced OPSEC fork of Donut. Features a Custom in-memory CLR Host, Tail-Jump ETW bypasses, and zero-patch AMSI evasion for stealthy shellcode generation.
Event Tracing for Windows EDR bypass in Rust (usermode)
A proof of concept AMSI & ETW bypass using trampolines for hooking and modifying execution flow
PoC on JIT Flow Redirection and .NET Reflection for Analyzing In-Memory Telemetry Interfaces (AMSI/ETW)
Modern WinRM shell for red teams and CTFs with automated tool staging, AV bypass, recon, and credential/loot extraction
Header-only Windows x64 indirect syscall library. Zero CRT, zero IAT, VEH anti-BP, AMSI/ETW bypass, W^X memory, per-call dynamic stubs.
CSEC notes - Windows internals, AV evasion, C2 frameworks. Built from live research with real tools tested against live AV engines.
Shellcode encryption and payload generator. AMSI/ETW bypass templates for red team and OSEP.
Standalone unrestricted PowerShell execution engine
Diabellstar is a Rust-based tool that performs ETW bypass by patching the NtTraceEvent function in ntdll.dll
Clean forensic traces on Linux, macOS, and Windows with Nyx. This alpha tool helps maintain privacy by removing various system artifacts. 🐙💻
Optimize terminal workflows with this collection of PowerShell 7 scripts, directory navigation shortcuts, and custom CLI file statistics tools.
Add a description, image, and links to the etw-bypass topic page so that developers can more easily learn about it.
To associate your repository with the etw-bypass topic, visit your repo's landing page and select "manage topics."