optiv/ScareCrow

Health v2 · maintenance only

Flags: archived no_license

Adoption not part of the score

2890 stars · 529 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

ScareCrow is a Go-based payload creation framework designed to bypass EDR (Endpoint Detection and Response) and application whitelisting controls. It generates sideloading loaders for Windows that remove EDR hooks from system DLLs in memory using techniques like DLL unhooking and indirect syscalls.

Use cases

• generate payloads that bypass EDR detection
• create sideloading loaders for legitimate Windows processes
• bypass application whitelisting controls
• unhook EDR hooks from system DLLs in memory
• test endpoint detection coverage with evasion techniques
• encrypt shellcode with multiple encryption methods

When to choose

• you are a red teamer or penetration tester testing EDR effectiveness
• you need to generate Windows loaders that sideload into legitimate processes
• you want to evaluate whether your EDR can detect DLL unhooking and indirect syscall techniques

When to avoid

• you want active development or support - this repository is archived and moved to Tylous/ScareCrow
• you need a defensive or detection tool rather than an offensive one
• you are not working on Windows targets
• you cannot accept the project having no license

Facets

cli-tool · maturity abandoned

security penetration-testing security penetration-testing developer-tools windows go cli edr-bypass payload-generation evasion red-team shellcode-loader archived

Member repositories

For agents

markdown · JSON · MCP: product_card(name="optiv/ScareCrow")