edr-bypass

There are 9 repositories under edr-bypass topic.

inceptor
klezVirus / inceptor
Template-Driven AV/EDR Evasion Framework
obfuscation pinvoke dinvoke code-injection process-injection av-bypass amsi-bypass av-evasion edr-bypass pe-packer amsi-evasion red-team red-teaming av-edr-bypass payload-generator
Language:Assembly 1502
tkmru / awesome-edr-bypass
Awesome EDR Bypass Resources For Ethical Hacking
awesome-lists edr edr-bypass
790
NUL0x4C / AtomPePacker
A Highly capable Pe Packer
edr-bypass packer pe
Language:C 667
DEFCON-31-Syscalls-Workshop
VirtualAlllocEx / DEFCON-31-Syscalls-Workshop
Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".
antivirus-bypass antivirus-evasion edr-bypass edr-evasion malware-development windows-internals direct-syscalls indirect-syscalls malware-analysis malware-development-guide workshop shellcode-loader syscalls shellcode
Language:C 559
Chimera
georgesotiriadis / Chimera
Automated DLL Sideloading Tool With EDR Evasion Capabilities
assembly cpp dll-sideloading edr-bypass offensive-security python3
Language:Python 438
WesleyWong420 / RedTeamOps-Havoc-101
Materials for the workshop "Red Team Ops: Havoc 101"
active-directory av-evasion edr-bypass opsec process-injection red-team-ops havoc
Language:C# 301
f1zm0 / acheron
indirect syscalls for AV/EDR evasion in Go assembly
evasion adversary-emulation av-evasion edr-bypass edr-evasion malware-research offensive-security red-team red-teaming assembly go golang
Language:Assembly 289
VirtualAlllocEx / Create-Thread-Shellcode-Fetcher
This POC gives you the possibility to compile a .exe to completely avoid statically detection by AV/EPP/EDR of your C2-shellcode and download and execute your C2-shellcode which is hosted on your (C2)-webserver.
shellcode-loader shellcode-injection antivirus-evasion edr-bypass msfvenom bypass-antivirus
Language:C++ 244
fortra / hw-call-stack
Use hardware breakpoints to spoof the call stack for both syscalls and API calls
edr-bypass stack-spoofing syscalls
Language:C 169
dobin / antnium
A C2 framework for initial access in Go
c2 edr-bypass initial-access rat remote-access
Language:Go 154
lolbin-poc
mrexodia / lolbin-poc
Small PoC of using a Microsoft signed executable as a lolbin.
edr-bypass malware poc redteam redteam-tools redteaming windbg windbg-extension
Language:C++ 128
VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls
The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls
av-bypass av-evasion direct-syscalls edr-bypass edr-evasion indirect-syscalls shellcode-loader windows-int
Language:C 124
VirtualAlllocEx / Direct-Syscalls-A-journey-from-high-to-low
Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).
av-bypass av-evasion direct-syscalls edr-bypass edr-evasion
Language:C 119
njcve / inflate.py
Artificially inflate a given binary to exceed common EDR file size limits. Can be used to bypass common EDR.
antivirus antivirus-evasion av-bypass av-evasion bugbounty edr-bypass endpoint-security evasion-attack
Language:Python 115
V-i-x-x / AMSI-BYPASS
"AMSI WRITE RAID" Vulnerability that leads to an effective AMSI BYPASS
0day amsi-bypass amsi-evasion amsi-patch av avbypass edr-bypass vulnerability pentest pentesting malware
Language:PowerShell 108
VirtualAlllocEx / DSC_SVC_REMOTE
This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service path, etc. The payload itself can be remotely hosted, downloaded via the wininet library and then executed via direct system calls.
av-bypass av-evasion direct-syscalls edr-bypass edr-evasion
Language:C 47
SideloadFinder
roadwy / SideloadFinder
frida based script which automates the process of discovering and exploiting DLL Hijacks in target binaries. The discovered binaries can later be weaponized during Red Team Operations to evade AV/EDR's.
bypass-antivirus bypass-edr dll-hijacking redteam dll-sideloading edr-bypass
Language:Python 45
itaymigdal / PichichiH0ll0wer
Nim process hollowing loader
edr-bypass edr-evasion loader payload-generator payload-injector pe-loader penetration-testing penetration-testing-tools process-hollowing process-injection red-team red-team-tools runpe syscalls
Language:Nim 43
0mWindyBug / MinifilterHook
silence file system monitoring components by hooking their minifilters
driver edr-bypass hooking kernel minifilter windows
Language:C 34
PowerJoker
Adkali / PowerJoker
PowerJoker is a Dynamic PowerShell Reverse-Shell Generator; Unique Payloads with different results on Each Execution.
edr-bypass evade execution github linux methods obfuscation offensive-security python3 reverse-shell windows-10 windows-11 execute joker obfuscate-strings power powershell python-reverse-shell windows-reverse-shell powershell-reverse-shell
Language:Python 27
CodeXTF2 / evasion-adventures-files
Slides and POC demo for my talk at Divizion Zero on EDR evasion titled "Evasion Adventures"
edr-bypass hooking frida unhooking red-teaming pentesting poc
Language:C++ 21
x0reaxeax / SilentWrite
PoC arbitrary WPM without a process handle
detection-evasion edr-evasion popcalc redteam remote-write shellcode shellcode-execute windows wpm x86-64 av-evasion edr-bypass injection shellcode-injection shellcode-injector
Language:C 16
VirtualAlllocEx / Create_Thread_Inline_Assembly_x86
This POC provides the possibilty to execute x86 shellcode in form of a .bin file based on x86 inline assembly
av-bypass av-evasion edr-bypass edr-evasion inline-assembly
Language:C++ 15
melotic / nanostorm
An (WIP) EDR Evasion tool for x64 Windows & Linux binaries that utilizes Nanomites, written in Rust.
edr-bypass edr-evasion obfuscation rust
Language:Rust 13
VirtualAlllocEx / Shell-we-Assembly
Shellcode execution via x86 inline assembly based on MSVC syntax
av-bypass av-evasion edr-bypass edr-evasion inline-assembly windows-internals
Language:C++ 12
x0reaxeax / SysCook64
Indirect Syscall invocation via thread hijacking
edr-bypass edr-evasion hook-bypass indirect-syscall thread-context detection-evasion redteam
Language:C 12
x0reaxeax / SyscallHookBypass
NTAPI hook bypass with (semi) legit stack trace
antihooking av-bypass av-evasion edr-bypass windows hook-bypass x86 indirect-syscall detection-evasion redteam
Language:C 10
VirtualAlllocEx / Create_Thread-Inline_Assembly_x86_Fibers
This POC provides the ability to execute x86 shellcode in the form of a .bin file based on x86 inline assembly and execution over fibers
av-bypass av-evasion edr-bypass edr-evasion inline-assembly
Language:C++ 6
oldkingcone / BYOSI
Evade EDR's the simple way, by not touching any of the API's they hook.
a edr-bypass edr-evasion is thing this why
Language:PHP 5
nuts7 / RedTeaming-Tactics-and-Techniques
Red Teaming Tactics and Techniques
antivirus antivirus-bypass antivirus-evasion cheatsheet edr edr-bypass edr-evasion evasion redteam
Language:PowerShell 4
asciistring / Kraken-Crypter-v5-Native-Turbo-
Kraken Crypter v5 (Native/Turbo)
bypass-antivirus edr-bypass fud-bypass fud-crypter fud-crypter-2023 fud-crypter-2024 fully-undetectable runtime-analysis bypass-defender bypass-windows-defender shellcode-injection silent-exploit silent-exploit-pdf
2
Hanbry / Custom-PE-Packer
Custom binary file packer/encoder with integrated decoder stub. A pentest-tool for modern EDR evasion.
binary-loaders edr-bypass edr-evasion packer
Language:C 2
carboncryptt / CarbonCrypt
Carbon Crypter / Packer
bypass-av backdoor bypass-antivirus crypter download edr-bypass fud packer remote-execution remoteshell runpe stealer stealer-fud stealer-undetected token-grabber trojan undected undetectable windows
1
nuts7 / EDRSandblast
EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections (Notify Routine callbacks, Object Callbacks and ETW TI provider) and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring.
antivirus antivirus-bypass antivirus-evasion edr edr-bypass edr-evasion evasion
Language:C 1
nuts7 / Unprotect_Submission
Repository to publish your evasion techniques and contribute to the project
antivirus antivirus-bypass antivirus-evasion edr edr-bypass edr-evasion evasion redteam
Language:C++ 1
SnipSnapp / Random-Powershell
Mostly malicious or abusable powershell I've written
edr-bypass edr-evasion evasion-attacks powershell-script windows winnt administrative-privileges
Language:PowerShell 1

edr-bypass

klezVirus / inceptor

tkmru / awesome-edr-bypass

NUL0x4C / AtomPePacker

VirtualAlllocEx / DEFCON-31-Syscalls-Workshop

georgesotiriadis / Chimera

WesleyWong420 / RedTeamOps-Havoc-101

f1zm0 / acheron

VirtualAlllocEx / Create-Thread-Shellcode-Fetcher

fortra / hw-call-stack

dobin / antnium

mrexodia / lolbin-poc

VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls

VirtualAlllocEx / Direct-Syscalls-A-journey-from-high-to-low

njcve / inflate.py

V-i-x-x / AMSI-BYPASS

VirtualAlllocEx / DSC_SVC_REMOTE

roadwy / SideloadFinder

itaymigdal / PichichiH0ll0wer

0mWindyBug / MinifilterHook

Adkali / PowerJoker

CodeXTF2 / evasion-adventures-files

x0reaxeax / SilentWrite

VirtualAlllocEx / Create_Thread_Inline_Assembly_x86

melotic / nanostorm

VirtualAlllocEx / Shell-we-Assembly

x0reaxeax / SysCook64

x0reaxeax / SyscallHookBypass

VirtualAlllocEx / Create_Thread-Inline_Assembly_x86_Fibers

oldkingcone / BYOSI

nuts7 / RedTeaming-Tactics-and-Techniques

asciistring / Kraken-Crypter-v5-Native-Turbo-

Hanbry / Custom-PE-Packer

carboncryptt / CarbonCrypt

nuts7 / EDRSandblast

nuts7 / Unprotect_Submission

SnipSnapp / Random-Powershell