edr

There are 28 repositories under edr topic.

BypassAV
matro7sh / BypassAV
This map lists the essential techniques to bypass anti-virus and EDR
av bypass edr markdown mindmap pentest redteam
2756
bytedance / Elkeid
Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices.
cwpp edr hids linux-security rasp security
Language:Go 2372
rabbitstack / fibratus
Adversary tradecraft detection, protection, and hunting
adversary blueteam edr etw golang instrumentation python security windows windows-kernel
Language:Go 2289
BLUESPAWN
ION28 / BLUESPAWN
An Active Defense and EDR software to empower Blue Teams
active-defense windows security security-tools blue-team mitre-attack anti-virus edr threat-hunting
Language:C++ 1294
0xrawsec / whids
Open Source EDR for Windows
dfir threat-hunting windows ids sysmon edr
Language:Go 1273
BestEdrOfTheMarket
Xacone / BestEdrOfTheMarket
AV/EDR Evasion Lab for Training & Learning Purposes
edr defense-evasion edr-evasion edr-testing kernel-development kernel-driver
Language:C++ 1230
tkmru / awesome-edr-bypass
Awesome EDR Bypass Resources For Ethical Hacking
awesome-lists edr edr-bypass redteam redteaming
1151
xuanxuan0 / DripLoader
Evasive shellcode loader for bypassing event-based injection detection (PoC)
shellcode shellcode-loader shellcode-injector edr evasion-attacks
Language:C++ 807
jthuraisamy / TelemetrySourcerer
Enumerate and disable common sources of telemetry used by AV/EDR.
av edr evasion security-tools
Language:C++ 789
wecooperate / iMonitor
iMonitor（冰镜 - 终端行为分析系统）
edr malware-analysis open-procmon procmon reverse-engineering systemmonitor
Language:C++ 746
naksyn / Pyramid
a tool to help operate in EDRs' blind spots
edr edr-testing hacking python redteam-tools redteaming
Language:Python 724
RoomaSec / RmEye
戎码之眼是一个window上的基于att&ck模型的威胁监控工具.有效检测常见的未知威胁与已知威胁.防守方的利剑
edr sysmon threat-hunting
Language:Python 507
KQL
LearningKijo / KQL
Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.
edr incident-response kql kusto threat-hunting xdr
467
ScareCrow-CobaltStrike
GeorgePatsias / ScareCrow-CobaltStrike
Cobalt Strike script for ScareCrow payloads intergration (EDR/AV evasion)
cobaltstrike-cna edr scarecrow bypass-antivirus evasion dll exe wscript msiexec control excel
Language:Python 464
SitinCloud / Owlyshield
Owlyshield is an EDR framework designed to safeguard vulnerable applications from potential exploitation (C&C, exfiltration and impact).
cybersecurity antivirus behavior-analysis ransomware edr machine-learning malware malware-analysis malware-research threat-hunting command-and-control exfiltration impact
Language:Rust 416
BrightIntosh
niklasr22 / BrightIntosh
Unlock the full brightness of the XDR display of your MacBook Pro
brightness hdr macbook macbook-pro macos xdr apple bright brightness-control display mac nits swiftui edr swift
Language:Swift 411
wecooperate / iMonitorSDK
The world's most powerful System Activity Monitor Engine · 一款功能强大的终端行为采集防御开发套件 ~ 旨在帮助EDR、零信任、数据安全、审计管控等终端安全软件可以快速实现产品功能，而不用关心底层驱动的开发、维护和兼容性问题，让其可以专注于业务开发
sysmon defender edr security procmon endpoint-security monitoring-tool etw kernel zero-trust access-control
Language:C++ 352
kiding / wanna-see-a-whiter-white
CSS trick/bug to display a brighter white by exploiting browsers' HDR capability and Apple's EDR system
apple css edr hdr
Language:HTML 318
zeroperil / HookDump
Security product hook detection
edr hooking redteam-tools
Language:C++ 317
op7ic / EDR-Testing-Script
Test the accuracy of Endpoint Detection and Response (EDR) software with simple script which executes various ATT&CK/LOLBAS/Invoke-CradleCrafter/Invoke-DOSfuscation payloads
att edr edr-solutions incident-response mitre security security-audit
Language:Batchfile 301
NUL0x4C / KnownDllUnhook
Replace the .txt section of the current loaded modules from \KnownDlls\ to bypass edrs
bypass edr
Language:C 294
theSecHunter / Hades-Windows
Hades HIDS/HIPS for Windows
edr etw hids hips host-security kernel minifilter rootkit wfp window-security windows-driver
Language:C++ 278
xuanxuan0 / TiEtwAgent
PoC memory injection detection agent based on ETW, for offensive and defensive research purposes
detection edr injection memory-scanning security
Language:C 269
ion-storm / sysmon-edr
Sysmon EDR POC Build within Powershell to prove ability.
edr sysmon sysmon-edr
Language:PowerShell 224
MDEtester
LearningKijo / MDEtester
MDE Tester is designed to help testing various features in Microsoft Defender for Endpoint.
defenderforendpoint edr powershell testing
Language:PowerShell 188
ProcessusT / Venoma
Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution
antivirus bypass c2 cobalt dropper edr malware payload pentest red strike team indirect syscalls
Language:C++ 174
reveng007 / ReflectiveNtdll
A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber
antivirus dropper edr evasion fiber implant malware ntdll-unhooking systemfunction033 process-injection bypass bypass-antivirus
Language:C 171
V-i-x-x / kernel-callback-removal
kernel callback removal (Bypassing EDR Detections)
edr edr-bypass edr-evasion kernel
Language:C++ 160
ForensicMiner
securityjoes / ForensicMiner
A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
automation cortex crowdstrike cyber dfir edr fast forensics ir mdr powershell security soc xdr
Language:PowerShell 157
TH3xACE / EDR-Test
Automating EDR Testing with reference to MITRE ATTACK via Cobalt Strike [Purple Team].
aggressor-scripts cobalt-strike cobaltstrike edr mitre-attack purple-team purpleteam
150
UncoderIO / Uncoder_IO
An IDE and translation engine for detection engineers and threat hunters. Be faster, write smarter, keep 100% privacy.
datalake edr roota siem sigma threathunting translation uncoder uncoderio xdr
Language:Python 148
carbonblack / cbapi-python
Carbon Black API - Python language bindings
cbapi carbonblack api-wrapper python-bindings python carbon-black-cloud cb-defense cb-threathunter cb-liveops cb-protection cb-response app-control endpoint-standard audit-and-remediation enterprise-edr hosted-edr edr supported
Language:Python 145
ars3n11 / MineSweeper
Windows user-land hooks manipulation tool.
edr hooks unhooking windows
Language:C 142
UncoderIO / Roota
Roota is a public-domain language of threat detection and response that combines native queries from a SIEM, EDR, XDR, or Data Lake with standardized metadata and threat intelligence to enable automated translation into other languages
datalake edr roota siem xdr rootalanguage
125
redcanaryco / redcanary-response-utils
Tools to automate and/or expedite response.
security-tools edr
Language:Python 113
starkdmi / BrightXDR
Free and Open Source alternative to Vivid macOS application to extend Apple XDR display brightness from 500 up to 1600 nits.
brightness display edr hdr macos swift swiftui xdr vivid lunar apple macbook-pro
Language:Swift 113

edr

matro7sh / BypassAV

bytedance / Elkeid

rabbitstack / fibratus

ION28 / BLUESPAWN

0xrawsec / whids

Xacone / BestEdrOfTheMarket

tkmru / awesome-edr-bypass

xuanxuan0 / DripLoader

jthuraisamy / TelemetrySourcerer

wecooperate / iMonitor

naksyn / Pyramid

RoomaSec / RmEye

LearningKijo / KQL

GeorgePatsias / ScareCrow-CobaltStrike

SitinCloud / Owlyshield

niklasr22 / BrightIntosh

wecooperate / iMonitorSDK

kiding / wanna-see-a-whiter-white

zeroperil / HookDump

op7ic / EDR-Testing-Script

NUL0x4C / KnownDllUnhook

theSecHunter / Hades-Windows

xuanxuan0 / TiEtwAgent

ion-storm / sysmon-edr

LearningKijo / MDEtester

ProcessusT / Venoma

reveng007 / ReflectiveNtdll

V-i-x-x / kernel-callback-removal

securityjoes / ForensicMiner

TH3xACE / EDR-Test

UncoderIO / Uncoder_IO

carbonblack / cbapi-python

ars3n11 / MineSweeper

UncoderIO / Roota

redcanaryco / redcanary-response-utils

starkdmi / BrightXDR