Creating covert system threads on Windows by leveraging the page tables and IDT
Appears on
Quick read
Latest capture 2026-07-29 03:06
0 paths
Agent instructions and tool configuration found in this repository.
No config files detected.
3 observed captures since 2026-06-24. Charts use measured snapshots only.
Stars from first capture 0
All tracked data
Observed snapshots
Observed snapshots
Nearest indexed repositories by embedding similarity.
Process Injection using Thread Name
Manual DLL Injector using Thread Hijacking.
A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.html#dirty-vanity-a-new-approach-to-code-injection--edr-bypass-28417
A proof of concept demonstrating instrumentation callbacks on Windows 10 21h1 with a TLS variable to ensure all syscalls are caught.
A proof of concept demonstrating communication via mapped shared memory structures between a user-mode process and a kernel-mode payload on Windows 10 20H2.
BattlEye compatible injector, done completely from user-mode.
