github.com/frkngksl/nimicstack v0.0.0-20260404115907-bb0447efbe80
References a public code-forge URLGitHub versioned zip filename
SHA-256057e0b04c93910a9df3ea7f8d8c89e3b2591b43729d94b66b5896914f4b68db8
URLhttps://proxy.golang.org/github.com/frkngksl/nimicstack/@v/v0.0.0-20260404115907-bb0447efbe80.zip
MaleculeH(Cm₂)Md(Pa)
Evidence
0# NimicStack
NimicStack is the pure Nim implementation of Call Stack Spoofing technique to mimic legitimate programs. Whole pr
261ation
You can directly compile the source code with the following command:
`nim c -d=mingw --app=console --cpu=amd64 -o:NimicStack.exe .\Main.nim`
593ic three example call stacks which are WMI, RPC and Svchost while opening the LSASS process.
`.\NimicStack.exe <--wmi, --rpc, --svchost>`
Example output for mimicked WMI call stack:
```
PS C:\Users\test\Desktop\NimicStack> .\NimicStack.exe --wmi
█�
2584l stack from Sysmon!
```
And Sysmon output for this call:
<img width="1246" alt="image" src="https://user-images.githubusercontent.com/26549173/182203399-9ace7885-cd7a-40a5-bb75-fd7d71c896cf.png">
# References
- https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs/
- https://github.com/countercept/CallStackSpoofer
# Disclaimer
For authorized security testing only. Misuse of this tool against systems without explicit permission is illegal.
1MIT License
2
3Copyright (c) 2026 Furkan Göksel
4
5Permission is hereby granted, free of charge, to any person obtaining a copy
6of this software and associated documentation files (the "Software"), to deal
7in the Software without restriction, including without limitation the righ …
No evidence locations were recorded for this file. Raw result