ScareCrow loader

ScareCrow -I shellcode.bin -Loader excel

Generates a signed payload loader that executes via legitimate processes (msiexec, regsvr32, WMI, Excel) to evade EDR.

Run it when the vanilla payload (beacon, shellcode) is caught by EDR on the fly: ScareCrow wraps the shellcode in a signed executable or add-in and launches it through LOLBins. The result looks like legitimate software to static scanning.

Does not evade EDR with behavioral analysis: the final injection (CreateRemoteThread, for example) looks the same. The certificate it generates by default has no root trust: if the environment requires chain-verified signatures, the loader trips or fails to execute.