← All tools

ScareCrow

https://github.com/optiv/ScareCrow

Open Source

Categories

Evasion

Description

Payload creation framework focused on EDR bypass. Creates loaders using a variety of techniques including side-loading, binary padding, expired code signing certificates, and ETW/AMSI patching.

Keywords

EDR bypass payload side-loading code signing AMSI bypass ETW loader AV evasion

Example Usage

ScareCrow -Loader side-load -domain microsoft.com -I shellcode.bin -O malware.dll
ScareCrow -Loader binary -domain google.com -I shellcode.bin -O payload.exe