edr-bypass

There are 15 repositories under edr-bypass topic.

inceptor
klezVirus / inceptor
Template-Driven AV/EDR Evasion Framework
obfuscation pinvoke dinvoke code-injection process-injection av-bypass amsi-bypass av-evasion edr-bypass pe-packer amsi-evasion red-team red-teaming av-edr-bypass payload-generator
Language:Assembly 1744
tkmru / awesome-edr-bypass
Awesome EDR Bypass Resources For Ethical Hacking
awesome-lists edr edr-bypass redteam redteaming
1332
thomasxm / BOAZ_beta
Multilayered AV/EDR Evasion Framework
antivirus-evasion av-bypass av-edr-bypass av-evasion boaz code-injection edr-bypass etw-bypass obfuscation payload-generator pe-packer process-injection red-ream red-teaming red-teaming-tools
Language:C++ 845
DEFCON-31-Syscalls-Workshop
VirtualAlllocEx / DEFCON-31-Syscalls-Workshop
Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".
antivirus-bypass antivirus-evasion edr-bypass edr-evasion malware-development windows-internals direct-syscalls indirect-syscalls malware-analysis malware-development-guide workshop shellcode-loader syscalls shellcode
Language:C 718
Chimera
georgesotiriadis / Chimera
Automated DLL Sideloading Tool With EDR Evasion Capabilities
assembly cpp dll-sideloading edr-bypass offensive-security python3
Language:Python 492
WesleyWong420 / RedTeamOps-Havoc-101
Materials for the workshop "Red Team Ops: Havoc 101"
active-directory av-evasion edr-bypass opsec process-injection red-team-ops havoc
Language:C# 387
f1zm0 / acheron
indirect syscalls for AV/EDR evasion in Go assembly
evasion adversary-emulation av-evasion edr-bypass edr-evasion malware-research offensive-security red-team red-teaming assembly go golang
Language:Assembly 339
V-i-x-x / AMSI-WRITE-RAID-BYPASS
"AMSI WRITE RAID" Vulnerability that leads to an effective AMSI BYPASS
0day amsi-bypass amsi-evasion amsi-patch av avbypass edr-bypass vulnerability pentest pentesting malware
Language:PowerShell 309
Offensive-Panda / RWX_MEMEORY_HUNT_AND_INJECTION_DV
Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.
avbypass edr-bypass fud malware-development shellcode
Language:C++ 287
VirtualAlllocEx / Create-Thread-Shellcode-Fetcher
This POC gives you the possibility to compile a .exe to completely avoid statically detection by AV/EPP/EDR of your C2-shellcode and download and execute your C2-shellcode which is hosted on your (C2)-webserver.
shellcode-loader shellcode-injection antivirus-evasion edr-bypass msfvenom bypass-antivirus
Language:C++ 257
VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls
The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls
av-bypass av-evasion direct-syscalls edr-bypass edr-evasion indirect-syscalls shellcode-loader windows-int
Language:C 214
fortra / hw-call-stack
Use hardware breakpoints to spoof the call stack for both syscalls and API calls
edr-bypass stack-spoofing syscalls
Language:C 197
V-i-x-x / kernel-callback-removal
kernel callback removal (Bypassing EDR Detections)
edr edr-bypass edr-evasion kernel
Language:C++ 197
dobin / antnium
A C2 framework for initial access in Go
c2 edr-bypass initial-access rat remote-access
Language:Go 193
j3h4ck / WatchDogKiller
PoC exploit for the vulnerable WatchDog Anti-Malware driver (amsdk.sys) – weaponized to kill protected EDR/AV processes via BYOVD.
av-bypass av-evasion byovd edr edr-bypass edr-evasion
Language:C++ 172
oldkingcone / BYOSI
Evade EDR's the simple way, by not touching any of the API's they hook.
edr-bypass edr-evasion php powershell redteam
Language:PHP 162
VirtualAlllocEx / Direct-Syscalls-A-journey-from-high-to-low
Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).
av-bypass av-evasion direct-syscalls edr-bypass edr-evasion
Language:C 143
lolbin-poc
mrexodia / lolbin-poc
Small PoC of using a Microsoft signed executable as a lolbin.
edr-bypass malware poc redteam redteam-tools redteaming windbg windbg-extension
Language:C++ 139
voidvxvt / HellBunny
Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks
api-hashing direct-syscalls dll dll-sideloading edr-bypass edr-evasion iat-camouflage indirect-syscalls maldev malware-development msvc native-api ntapi payload-encryption process-injection shellcode-injection shellcode-loader windows
Language:C 129
njcve / inflate.py
Artificially inflate a given binary to exceed common EDR file size limits. Can be used to bypass common EDR.
antivirus antivirus-evasion av-bypass av-evasion bugbounty edr-bypass endpoint-security evasion-attack
Language:Python 120
CroodSolutions / AutoPwnKey
AutoPwnKey is a red teaming framework and testing tool using AutoHotKey (AHK), which at the time of creation proves to be quite evasive. It is our hope that this tool will be useful to red teams over the short term, while over the long term help AV/EDR vendors improve how they handle AHK scripts.
ahk ahk-script attack-simulation av-bypass av-evasion edr-bypass edr-evasion evasion-techniques exploit-code exploit-development exploitation-framework purple-team purpleteam
Language:AutoHotkey 108
CroodSolutions / BeaconatorC2
BeaconatorC2 is a framework for red teaming and adversarial emulation, providing a full-featured management interface, along with a catalog of beacons and a clear schema to add more beacons over time.
adversarial-attacks c2 command-and-control credential-dumping dll-unhooking edr-bypass edr-evasion metasploit-install pentest-tool purple-teaming red-team-tools
Language:Python 85
Chainski / PandaLoader
A WIP shellcode loader tool which bypasses AV/EDR, coded in C++, and equipped with a minimal builder.
bypass-antivirus edr-bypass etw-bypass etw-evasion evasion malware obfuscation pe-loader powershell shellcode shellcode-encoder shellcode-loader xor-encryption persistence crypter payload-generator redteam
Language:C++ 77
0xflux / Rust-Hells-Gate
Rust malware EDR evasion via direct syscalls, fully implemented as an example in Rust
edr-bypass edr-evasion malware malware-research pentest pentest-tool pentesting redteam redteam-tools redteaming rust rust-lang hellsgate offensive-security hells-gate antivirus-bypass antivirus-evasion bypass-antivirus bypass-edr
Language:Rust 68
PowerJoker
Adkali / PowerJoker
PowerJoker is a Python program which generate a Dynamic PowerShell Reverse-Shell Generator; Unique Payloads with different results on Each Execution.
edr-bypass evade execution github linux methods obfuscation offensive-security python3 reverse-shell windows-10 windows-11 execute joker obfuscate-strings power powershell python-reverse-shell windows-reverse-shell powershell-reverse-shell
Language:Python 65
itaymigdal / PichichiH0ll0wer
Nim process hollowing loader
edr-bypass edr-evasion loader payload-generator payload-injector pe-loader penetration-testing penetration-testing-tools process-hollowing process-injection red-team red-team-tools runpe syscalls
Language:Nim 60
0mWindyBug / MinifilterHook
silence file system monitoring components by hooking their minifilters
driver edr-bypass hooking kernel minifilter windows
Language:C 59
NanoWraith / BlindEdr
A Blind EDR Project for Educational Purposes
driver edr-bypass edr-evasion malware
Language:C 58
VirtualAlllocEx / DSC_SVC_REMOTE
This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service path, etc. The payload itself can be remotely hosted, downloaded via the wininet library and then executed via direct system calls.
av-bypass av-evasion direct-syscalls edr-bypass edr-evasion
Language:C 55
SideloadFinder
roadwy / SideloadFinder
frida based script which automates the process of discovering and exploiting DLL Hijacks in target binaries. The discovered binaries can later be weaponized during Red Team Operations to evade AV/EDR's.
bypass-antivirus bypass-edr dll-hijacking dll-sideloading edr-bypass redteam
Language:Python 52
coleak2021 / hidedump
Hidedump:a lsassdump tools that may bypass EDR
c lsass-dump windows bypass-av edr-bypass
Language:C 50
andrecrafts / CobaltStrike-YARA-Bypass-f0b627fc
Bypass YARA rule Windows_Trojan_CobaltStrike_f0b627fc by generating alternative shellcode sequences.
automatization cobalt-strike edr-bypass edr-evasion python yara-rules
Language:Python 49
micREsoft / SysCaller
SysCaller: SDK for WindowsAPI via syscalls. Dynamic Resolution, Obfuscation, Multi-Language Bindings, & more!
reverse-engineering windows masm ntdll syscall obfuscation redteam security syscalls
Language:C 49
EvilBytecode / Ntdll-Unhook
Unhook Ntdll.dll, Go & C++.
av edr-bypass edr-evasion evasion fud ntdll-unhooking
Language:C++ 31
CodeXTF2 / evasion-adventures-files
Slides and POC demo for my talk at Divizion Zero on EDR evasion titled "Evasion Adventures"
edr-bypass frida hooking pentesting poc red-teaming unhooking
Language:C++ 30
0xflux / ETW-Bypass-Rust
Event Tracing for Windows EDR bypass in Rust (usermode)
edr edr-bypass edr-evasion ethical-hacking ethical-hacking-tools etw etw-bypass etw-evasion hacking malware malware-research pentest pentest-tool pentesting red-team redteam redteam-tools redteaming rust
Language:Rust 27

edr-bypass

klezVirus / inceptor

tkmru / awesome-edr-bypass

thomasxm / BOAZ_beta

VirtualAlllocEx / DEFCON-31-Syscalls-Workshop

georgesotiriadis / Chimera

WesleyWong420 / RedTeamOps-Havoc-101

f1zm0 / acheron

V-i-x-x / AMSI-WRITE-RAID-BYPASS

Offensive-Panda / RWX_MEMEORY_HUNT_AND_INJECTION_DV

VirtualAlllocEx / Create-Thread-Shellcode-Fetcher

VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls

fortra / hw-call-stack

V-i-x-x / kernel-callback-removal

dobin / antnium

j3h4ck / WatchDogKiller

oldkingcone / BYOSI

VirtualAlllocEx / Direct-Syscalls-A-journey-from-high-to-low

mrexodia / lolbin-poc

voidvxvt / HellBunny

njcve / inflate.py

CroodSolutions / AutoPwnKey

CroodSolutions / BeaconatorC2

Chainski / PandaLoader

0xflux / Rust-Hells-Gate

Adkali / PowerJoker

itaymigdal / PichichiH0ll0wer

0mWindyBug / MinifilterHook

NanoWraith / BlindEdr

VirtualAlllocEx / DSC_SVC_REMOTE

roadwy / SideloadFinder

coleak2021 / hidedump

andrecrafts / CobaltStrike-YARA-Bypass-f0b627fc

micREsoft / SysCaller

EvilBytecode / Ntdll-Unhook

CodeXTF2 / evasion-adventures-files

0xflux / ETW-Bypass-Rust