edr

There are 23 repositories under edr topic.

BypassAV
matro7sh / BypassAV
This map lists the essential techniques to bypass anti-virus and EDR
av bypass edr mindmap pentest redteam markdown
2221
bytedance / Elkeid
Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices.
cwpp edr hids linux-security rasp security
Language:Go 2112
rabbitstack / fibratus
A modern tool for Windows kernel exploration and tracing with a focus on security
edr golang instrumentation python security windows windows-kernel
Language:Go 2086
BLUESPAWN
ION28 / BLUESPAWN
An Active Defense and EDR software to empower Blue Teams
active-defense windows security security-tools blue-team mitre-attack anti-virus edr threat-hunting
Language:C++ 1210
0xrawsec / whids
Open Source EDR for Windows
dfir threat-hunting windows ids sysmon edr
Language:Go 1054
Xacone / BestEdrOfTheMarket
Little user-mode AV/EDR evasion lab for training & learning purposes
defense-evasion edr edr-evasion edr-testing
Language:C++ 918
tkmru / awesome-edr-bypass
Awesome EDR Bypass Resources For Ethical Hacking
awesome-lists edr edr-bypass
785
jthuraisamy / TelemetrySourcerer
Enumerate and disable common sources of telemetry used by AV/EDR.
av edr evasion security-tools
Language:C++ 736
xuanxuan0 / DripLoader
Evasive shellcode loader for bypassing event-based injection detection (PoC)
shellcode shellcode-loader shellcode-injector edr evasion-attacks
Language:C++ 686
wecooperate / iMonitor
iMonitor（冰镜 - 终端行为分析系统）
procmon systemmonitor edr open-procmon malware-analysis reverse-engineering
Language:C++ 674
naksyn / Pyramid
a tool to help operate in EDRs' blind spots
edr edr-testing hacking python redteam-tools redteaming
Language:Python 615
ScareCrow-CobaltStrike
GeorgePatsias / ScareCrow-CobaltStrike
Cobalt Strike script for ScareCrow payloads intergration (EDR/AV evasion)
cobaltstrike-cna edr scarecrow bypass-antivirus evasion dll exe wscript msiexec control excel
Language:Python 447
RoomaSec / RmEye
戎码之眼是一个window上的基于att&ck模型的威胁监控工具.有效检测常见的未知威胁与已知威胁.防守方的利剑
edr sysmon threat-hunting
Language:Python 402
KQL
LearningKijo / KQL
Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.
edr incident-response kql kusto threat-hunting xdr
398
SitinCloud / Owlyshield
Owlyshield is an EDR framework designed to safeguard vulnerable applications from potential exploitation (C&C, exfiltration and impact).
cybersecurity antivirus behavior-analysis ransomware edr machine-learning malware malware-analysis malware-research threat-hunting command-and-control exfiltration impact
Language:Rust 372
wecooperate / iMonitorSDK
系统监控开发套件（sysmon、procmon、edr、终端安全、主机安全、零信任、上网行为管理、沙箱）
sysmon defender edr security procmon endpoint-security monitoring-tool etw kernel zero-trust access-control
Language:C++ 327
zeroperil / HookDump
Security product hook detection
edr hooking redteam-tools
Language:C++ 300
NUL0x4C / KnownDllUnhook
Replace the .txt section of the current loaded modules from \KnownDlls\ to bypass edrs
bypass edr
Language:C 281
op7ic / EDR-Testing-Script
Test the accuracy of Endpoint Detection and Response (EDR) software with simple script which executes various ATT&CK/LOLBAS/Invoke-CradleCrafter/Invoke-DOSfuscation payloads
edr mitre att security-audit security edr-solutions incident-response
Language:Batchfile 278
kiding / wanna-see-a-whiter-white
CSS trick/bug to display a brighter white by exploiting browsers' HDR capability and Apple's EDR system
css hdr edr apple
Language:HTML 270
xuanxuan0 / TiEtwAgent
PoC memory injection detection agent based on ETW, for offensive and defensive research purposes
detection security injection edr memory-scanning
Language:C 231
ion-storm / sysmon-edr
Sysmon EDR POC Build within Powershell to prove ability.
edr sysmon sysmon-edr
Language:PowerShell 209
BrightIntosh
niklasr22 / BrightIntosh
Unlock the full brightness of the XDR display of your MacBook Pro
apple bright brightness brightness-control collaborate display edr hdr mac macbook macbook-pro macos nits swift swiftui xdr
Language:Swift 201
utmstack / UTMStack
Customizable SIEM and XDR powered by Real-Time correlation and Threat Intelligence
compliance correlation edr incident-response log-management siem threat-intelligence threat-management utmstack xdr
Language:Java 185
reveng007 / ReflectiveNtdll
A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber
antivirus bypass bypass-antivirus dropper edr evasion fiber implant malware ntdll-unhooking process-injection systemfunction033
Language:C 160
carbonblack / cbapi-python
Carbon Black API - Python language bindings
cbapi carbonblack api-wrapper python-bindings python carbon-black-cloud cb-defense cb-threathunter cb-liveops cb-protection cb-response app-control endpoint-standard audit-and-remediation enterprise-edr hosted-edr edr supported
Language:Python 148
TH3xACE / EDR-Test
Automating EDR Testing with reference to MITRE ATTACK via Cobalt Strike [Purple Team].
aggressor-scripts cobalt-strike cobaltstrike edr mitre-attack purple-team purpleteam
143
MDEtester
LearningKijo / MDEtester
MDE Tester is designed to help testing various features in Microsoft Defender for Endpoint.
defenderforendpoint edr powershell testing
Language:PowerShell 140
ars3n11 / MineSweeper
Windows user-land hooks manipulation tool.
hooks edr windows unhooking
Language:C 137
ForensicMiner
securityjoes / ForensicMiner
A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
automation cortex crowdstrike cyber dfir edr fast forensics ir mdr powershell security soc xdr
Language:PowerShell 134
redcanaryco / redcanary-response-utils
Tools to automate and/or expedite response.
edr security-tools
Language:Python 112
UncoderIO / Uncoder_IO
An IDE and translation engine for detection engineers and threat hunters. Be faster, write smarter, keep 100% privacy.
datalake edr roota siem sigma threathunting translation xdr uncoder uncoderio
Language:Python 105
UncoderIO / RootA
Roota is a public-domain language of threat detection and response that combines native queries from a SIEM, EDR, XDR, or Data Lake with standardized metadata and threat intelligence to enable automated translation into other languages
datalake edr roota siem xdr rootalanguage
102
ProcessusT / Venoma
Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution
antivirus bypass c2 cobalt dropper edr malware payload pentest red strike team indirect syscalls
Language:C++ 96
WhiteBeam
WhiteBeamSec / WhiteBeam
WhiteBeam: Transparent endpoint security
edr rust security epp whitelisting application-whitelisting security-hardening
Language:Rust 95
Condor
MrEmpy / Condor
「🛡️」AVs/EDRs Evasion tool
antivirus antivirus-evasion av bypass defender edr evasion hacking injection loader protection python security shellcode windows windows-defender xdr
Language:Python 83

edr

matro7sh / BypassAV

bytedance / Elkeid

rabbitstack / fibratus

ION28 / BLUESPAWN

0xrawsec / whids

Xacone / BestEdrOfTheMarket

tkmru / awesome-edr-bypass

jthuraisamy / TelemetrySourcerer

xuanxuan0 / DripLoader

wecooperate / iMonitor

naksyn / Pyramid

GeorgePatsias / ScareCrow-CobaltStrike

RoomaSec / RmEye

LearningKijo / KQL

SitinCloud / Owlyshield

wecooperate / iMonitorSDK

zeroperil / HookDump

NUL0x4C / KnownDllUnhook

op7ic / EDR-Testing-Script

kiding / wanna-see-a-whiter-white

xuanxuan0 / TiEtwAgent

ion-storm / sysmon-edr

niklasr22 / BrightIntosh

utmstack / UTMStack

reveng007 / ReflectiveNtdll

carbonblack / cbapi-python

TH3xACE / EDR-Test

LearningKijo / MDEtester

ars3n11 / MineSweeper

securityjoes / ForensicMiner

redcanaryco / redcanary-response-utils

UncoderIO / Uncoder_IO

UncoderIO / RootA

ProcessusT / Venoma

WhiteBeamSec / WhiteBeam

MrEmpy / Condor