optiv/Mangle

Health v2 · maintenance only

Flags: archived

Adoption not part of the score

1235 stars · 169 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Mangle is a Go-based CLI tool that manipulates compiled Windows executables (.exe and DLL) to evade EDR detection. It strips known indicator-of-compromise strings, inflates file size to bypass scanner limits, and clones code-signing certificates from legitimate files.

Use cases

• evade EDR detection of compiled executables
• remove Go indicator strings from PE files
• inflate binary size to bypass on-disk scanners
• clone code-signing certificates from legitimate files
• modify PE files to remove IoC strings
• prepare payloads for red team engagements

When to choose

• you need to modify Windows PE binaries to remove detection indicators
• you are doing authorized red team or penetration testing against EDR-protected environments
• you want to test how security products handle large or signed executables

When to avoid

• you need an actively maintained tool - this repo is archived and moved to Tylous/Mangle
• you need evasion for non-Windows binaries
• you lack authorization to test against security products
• you need cross-platform or Linux ELF support

Facets

cli-tool · maturity abandoned

security reverse-engineering cli security penetration-testing reverse-engineering windows windows cli go edr-evasion pe-manipulation code-signing malware-development red-team offensive-security

Member repositories

For agents

markdown · JSON · MCP: product_card(name="optiv/Mangle")