optiv/Freeze

Health v2 · maintenance only

Flags: archived

Adoption not part of the score

1476 stars · 193 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Freeze is a Go-based payload creation toolkit that generates Windows shellcode loaders designed to bypass EDR security controls. It uses suspended processes, direct syscalls, and ASLR-based techniques to remove userland EDR hooks and execute shellcode stealthily.

Use cases

• bypass EDR to execute shellcode on Windows
• generate stealthy shellcode loaders for red team engagements
• remove userland EDR hooks from a payload
• test endpoint detection controls against evasion techniques
• create payloads using suspended process and direct syscall techniques

When to choose

• you are a red teamer or penetration tester needing an EDR evasion payload generator
• you want to test whether your EDR detects suspended-process and direct-syscall shellcode execution
• you need a quick CLI tool to wrap shellcode in an evasive Windows loader

When to avoid

• you need a maintained tool - the original repo is archived and development moved to Tylous/Freeze
• you are not working on authorized offensive security or defensive testing
• you need cross-platform payload generation beyond Windows

Facets

cli-tool · maturity maintenance

security penetration-testing security penetration-testing windows windows cli go edr-bypass shellcode-loader red-team offensive-security direct-syscalls suspended-processes

Member repositories

For agents

markdown · JSON · MCP: product_card(name="optiv/Freeze")