Introducing DarkWidow (Dropper/PostExploitation Toolkit): Capabilities: 1. Indirect Dynamic Syscall 2. SSN + Syscall address sorting via Modified TartarusGate approach (Other capabilities are in the comments...)

3. Remote Process Injection via APC Early Bird 4. Spawns a sacrificial Process as the target process 5. ACG(Arbitrary Code Guard)/BlockDll mitigation policy on spawned process 6. PPID spoofing 7. Cursed Nt Api resolving from TIB 8. Cursed Nt API hash If admin, kill Event Log svc!

Shout out to these guys for directly/indirectly helping me out (Open Source Contribution :)): @SEKTOR7net @VirtualAllocEx @peterwintrsmith @D1rkMtr @Jean_Maes_1994 @0xBoku @_winterknife_

Congratulations, well done!

Thanks a lot sir, ur blog really helping me :)

Looks cool, great work!

Your project SPAWN really helped me to build this, previously when I was trying to grant both CIG and ACG mitigation policy to spawned process, I wasn't able to do that. After seeing your code and trying it out, it made much more sense to me. Thanks for that :)

Interesting. Adding this to my list of fun things to checkout. Nice work

Thank u! Glad my project was able to slid into your "list of interest things" :)

Nice man…

Thank u :)