edr-bypass

There are 14 repositories under edr-bypass topic.

inceptor
klezVirus / inceptor
Template-Driven AV/EDR Evasion Framework
obfuscation pinvoke dinvoke code-injection process-injection av-bypass amsi-bypass av-evasion edr-bypass pe-packer amsi-evasion red-team red-teaming av-edr-bypass payload-generator
Language:Assembly 1723
tkmru / awesome-edr-bypass
Awesome EDR Bypass Resources For Ethical Hacking
awesome-lists edr edr-bypass redteam redteaming
1284
thomasxm / BOAZ_beta
Multilayered AV/EDR Evasion Framework
boaz code-injection obfuscation av-bypass av-edr-bypass av-evasion edr-bypass etw-bypass payload-generator pe-packer process-injection red-teaming red-teaming-tools red-ream antivirus-evasion
Language:C++ 800
NUL0x4C / AtomPePacker
A Highly capable Pe Packer
edr-bypass packer pe
Language:C 697
DEFCON-31-Syscalls-Workshop
VirtualAlllocEx / DEFCON-31-Syscalls-Workshop
Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".
antivirus-bypass antivirus-evasion edr-bypass edr-evasion malware-development windows-internals direct-syscalls indirect-syscalls malware-analysis malware-development-guide workshop shellcode-loader syscalls shellcode
Language:C 695
Chimera
georgesotiriadis / Chimera
Automated DLL Sideloading Tool With EDR Evasion Capabilities
assembly cpp dll-sideloading edr-bypass offensive-security python3
Language:Python 470
WesleyWong420 / RedTeamOps-Havoc-101
Materials for the workshop "Red Team Ops: Havoc 101"
active-directory av-evasion edr-bypass opsec process-injection red-team-ops havoc
Language:C# 386
f1zm0 / acheron
indirect syscalls for AV/EDR evasion in Go assembly
evasion adversary-emulation av-evasion edr-bypass edr-evasion malware-research offensive-security red-team red-teaming assembly go golang
Language:Assembly 337
Offensive-Panda / RWX_MEMEORY_HUNT_AND_INJECTION_DV
Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.
avbypass edr-bypass fud malware-development shellcode
Language:C++ 282
V-i-x-x / AMSI-BYPASS
"AMSI WRITE RAID" Vulnerability that leads to an effective AMSI BYPASS
0day amsi-bypass amsi-evasion amsi-patch av avbypass edr-bypass vulnerability pentest pentesting malware
Language:PowerShell 270
VirtualAlllocEx / Create-Thread-Shellcode-Fetcher
This POC gives you the possibility to compile a .exe to completely avoid statically detection by AV/EPP/EDR of your C2-shellcode and download and execute your C2-shellcode which is hosted on your (C2)-webserver.
antivirus-evasion bypass-antivirus edr-bypass msfvenom shellcode-injection shellcode-loader
Language:C++ 253
VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls
The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls
av-bypass av-evasion direct-syscalls edr-bypass edr-evasion indirect-syscalls shellcode-loader windows-int
Language:C 208
fortra / hw-call-stack
Use hardware breakpoints to spoof the call stack for both syscalls and API calls
edr-bypass stack-spoofing syscalls
Language:C 197
dobin / antnium
A C2 framework for initial access in Go
c2 edr-bypass initial-access rat remote-access
Language:Go 194
V-i-x-x / kernel-callback-removal
kernel callback removal (Bypassing EDR Detections)
edr edr-bypass edr-evasion kernel
Language:C++ 189
oldkingcone / BYOSI
Evade EDR's the simple way, by not touching any of the API's they hook.
edr-bypass edr-evasion php powershell redteam
Language:PHP 154
VirtualAlllocEx / Direct-Syscalls-A-journey-from-high-to-low
Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).
av-bypass av-evasion direct-syscalls edr-bypass edr-evasion
Language:C 141
lolbin-poc
mrexodia / lolbin-poc
Small PoC of using a Microsoft signed executable as a lolbin.
edr-bypass malware poc redteam redteam-tools redteaming windbg windbg-extension
Language:C++ 136
voidvxvt / HellBunny
Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks
direct-syscalls edr-evasion indirect-syscalls maldev malware-development msvc native-api ntapi windows iat-camouflage payload-encryption process-injection edr-bypass api-hashing dll dll-sideloading shellcode-injection shellcode-loader
Language:C 121
njcve / inflate.py
Artificially inflate a given binary to exceed common EDR file size limits. Can be used to bypass common EDR.
antivirus antivirus-evasion av-bypass av-evasion bugbounty edr-bypass endpoint-security evasion-attack
Language:Python 120
CroodSolutions / AutoPwnKey
AutoPwnKey is a red teaming framework and testing tool using AutoHotKey (AHK), which at the time of creation proves to be quite evasive. It is our hope that this tool will be useful to red teams over the short term, while over the long term help AV/EDR vendors improve how they handle AHK scripts.
ahk ahk-script attack-simulation av-bypass av-evasion edr-bypass edr-evasion evasion-techniques exploit-code exploit-development exploitation-framework purple-team purpleteam
Language:AutoHotkey 107
0xflux / Rust-Hells-Gate
Rust malware EDR evasion via direct syscalls, fully implemented as an example in Rust
edr-bypass edr-evasion malware malware-research pentest pentest-tool pentesting redteam redteam-tools redteaming rust rust-lang hellsgate offensive-security hells-gate antivirus-bypass antivirus-evasion bypass-antivirus bypass-edr
Language:Rust 64
itaymigdal / PichichiH0ll0wer
Nim process hollowing loader
loader pe-loader penetration-testing penetration-testing-tools process-hollowing process-injection red-team red-team-tools syscalls payload-generator runpe payload-injector edr-bypass edr-evasion
Language:Nim 59
0mWindyBug / MinifilterHook
silence file system monitoring components by hooking their minifilters
driver edr-bypass hooking kernel minifilter windows
Language:C 56
VirtualAlllocEx / DSC_SVC_REMOTE
This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service path, etc. The payload itself can be remotely hosted, downloaded via the wininet library and then executed via direct system calls.
av-bypass av-evasion direct-syscalls edr-bypass edr-evasion
Language:C 54
SideloadFinder
roadwy / SideloadFinder
frida based script which automates the process of discovering and exploiting DLL Hijacks in target binaries. The discovered binaries can later be weaponized during Red Team Operations to evade AV/EDR's.
bypass-antivirus bypass-edr dll-hijacking dll-sideloading edr-bypass redteam
Language:Python 51
PowerJoker
Adkali / PowerJoker
PowerJoker is a Python program which generate a Dynamic PowerShell Reverse-Shell Generator; Unique Payloads with different results on Each Execution.
edr-bypass evade execution github linux methods obfuscation offensive-security python3 reverse-shell windows-10 windows-11 execute joker obfuscate-strings power powershell python-reverse-shell windows-reverse-shell powershell-reverse-shell
Language:Python 50
coleak2021 / hidedump
Hidedump:a lsassdump tools that may bypass EDR
c lsass-dump windows bypass-av edr-bypass
Language:C 50
Chainski / PandaLoader
A WIP shellcode loader tool which bypasses AV/EDR, coded in C++, and equipped with a minimal console builder.
bypass-antivirus edr-bypass etw-bypass etw-evasion evasion malware obfuscation pe-loader powershell shellcode shellcode-encoder shellcode-loader xor-encryption persistence crypter payload-generator redteam
Language:C++ 42
WafflesExploits / CobaltStrike-YARA-Bypass-f0b627fc
Repository of scripts from my blog post on bypassing the YARA rule Windows_Trojan_CobaltStrike_f0b627fc by generating alternative shellcode sequences.
automatization cobalt-strike edr-bypass edr-evasion python yara-rules
Language:Python 37
CodeXTF2 / evasion-adventures-files
Slides and POC demo for my talk at Divizion Zero on EDR evasion titled "Evasion Adventures"
edr-bypass frida hooking pentesting poc red-teaming unhooking
Language:C++ 30
k3lpi3b4nsh33 / BlindEdr
A Blind EDR Project for Educational Purposes
driver edr-bypass edr-evasion malware
Language:C 30
0xflux / ETW-Bypass-Rust
Event Tracing for Windows EDR bypass in Rust (usermode)
edr edr-bypass edr-evasion ethical-hacking ethical-hacking-tools etw etw-bypass etw-evasion hacking malware malware-research pentest pentest-tool pentesting red-team redteam redteam-tools redteaming rust
Language:Rust 28
EvilBytecode / Ntdll-Unhook
Unhook Ntdll.dll, Go & C++.
av edr-bypass edr-evasion evasion fud ntdll-unhooking
Language:C++ 21
VirtualAlllocEx / Create_Thread_Inline_Assembly_x86
This POC provides the possibilty to execute x86 shellcode in form of a .bin file based on x86 inline assembly
av-bypass av-evasion edr-bypass edr-evasion inline-assembly
Language:C++ 19
x0reaxeax / SilentWrite
PoC arbitrary WPM without a process handle
detection-evasion edr-evasion popcalc redteam remote-write shellcode shellcode-execute windows wpm x86-64 av-evasion edr-bypass injection shellcode-injection shellcode-injector
Language:C 19

edr-bypass

klezVirus / inceptor

tkmru / awesome-edr-bypass

thomasxm / BOAZ_beta

NUL0x4C / AtomPePacker

VirtualAlllocEx / DEFCON-31-Syscalls-Workshop

georgesotiriadis / Chimera

WesleyWong420 / RedTeamOps-Havoc-101

f1zm0 / acheron

Offensive-Panda / RWX_MEMEORY_HUNT_AND_INJECTION_DV

V-i-x-x / AMSI-BYPASS

VirtualAlllocEx / Create-Thread-Shellcode-Fetcher

VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls

fortra / hw-call-stack

dobin / antnium

V-i-x-x / kernel-callback-removal

oldkingcone / BYOSI

VirtualAlllocEx / Direct-Syscalls-A-journey-from-high-to-low

mrexodia / lolbin-poc

voidvxvt / HellBunny

njcve / inflate.py

CroodSolutions / AutoPwnKey

0xflux / Rust-Hells-Gate

itaymigdal / PichichiH0ll0wer

0mWindyBug / MinifilterHook

VirtualAlllocEx / DSC_SVC_REMOTE

roadwy / SideloadFinder

Adkali / PowerJoker

coleak2021 / hidedump

Chainski / PandaLoader

WafflesExploits / CobaltStrike-YARA-Bypass-f0b627fc

CodeXTF2 / evasion-adventures-files

k3lpi3b4nsh33 / BlindEdr

0xflux / ETW-Bypass-Rust

EvilBytecode / Ntdll-Unhook

VirtualAlllocEx / Create_Thread_Inline_Assembly_x86

x0reaxeax / SilentWrite