# optiv/ScareCrow

ScareCrow - Payload creation framework designed around EDR bypass.

Repository: https://github.com/optiv/ScareCrow
Canonical: https://ross.abutalabs.com/products/scarecrow
Language: Go
License Family: other
Archived: true
Last push: 2023-08-18T17:16:06+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 2047, "days_push": 1111, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: archived, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2890, forks 529 (observed 2026-08-28T04:07:28.340575+00:00)

## What it is
ScareCrow is a Go-based payload creation framework designed to bypass EDR (Endpoint Detection and Response) and application whitelisting controls. It generates sideloading loaders for Windows that remove EDR hooks from system DLLs in memory using techniques like DLL unhooking and indirect syscalls.

## Use cases
- generate payloads that bypass EDR detection
- create sideloading loaders for legitimate Windows processes
- bypass application whitelisting controls
- unhook EDR hooks from system DLLs in memory
- test endpoint detection coverage with evasion techniques
- encrypt shellcode with multiple encryption methods

## When to choose
- you are a red teamer or penetration tester testing EDR effectiveness
- you need to generate Windows loaders that sideload into legitimate processes
- you want to evaluate whether your EDR can detect DLL unhooking and indirect syscall techniques

## When to avoid
- you want active development or support - this repository is archived and moved to Tylous/ScareCrow
- you need a defensive or detection tool rather than an offensive one
- you are not working on Windows targets
- you cannot accept the project having no license

## Facets
- artifact type: cli-tool
- maturity: abandoned
- function: security, penetration-testing
- domain: security, penetration-testing, developer-tools
- platform: windows, go, cli
- tags: edr-bypass, payload-generation, evasion, red-team, shellcode-loader, archived

## Member repositories
- optiv/ScareCrow (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:28.340575+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:48:17.423241+00:00, confidence not recorded.
  - readme: https://github.com/optiv/ScareCrow (fetched 2026-08-28T04:07:28.340575+00:00, sha 32f5f7a383d0)
- Data as of 2026-08-30T08:39:29.467469+00:00.