edr-evasion

There are 9 repositories under edr-evasion topic.

BestEdrOfTheMarket
Xacone / BestEdrOfTheMarket
EDR Lab for Experimentation Purposes
edr defense-evasion edr-evasion edr-testing kernel-development kernel-driver
Language:C++ 1341
klezVirus / SilentMoonwalk
PoC Implementation of a fully dynamic call stack spoofer
av-evasion edr-evasion thread-stack stack-spoofing
Language:C++ 830
DEFCON-31-Syscalls-Workshop
VirtualAlllocEx / DEFCON-31-Syscalls-Workshop
Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".
antivirus-bypass antivirus-evasion edr-bypass edr-evasion malware-development windows-internals direct-syscalls indirect-syscalls malware-analysis malware-development-guide workshop shellcode-loader syscalls shellcode
Language:C 695
Accenture / Codecepticon
.NET/PowerShell/VBA Offensive Security Obfuscator
antivirus-evasion csharp edr-evasion obfuscation powershell vba accenture-security
Language:C# 489
pard0p / CallstackSpoofingPOC
C++ self-Injecting dropper based on various EDR evasion techniques.
av-evasion dropper edr-evasion indirect-syscall
Language:C 369
hades
f1zm0 / hades
Go shellcode loader that combines multiple evasion techniques
av-evasion edr-evasion golang pentesting red-teaming ntapi ntdll syscalls evasion adversary-emulation offensive-security
Language:Go 363
Kudaes / EPI
Threadless Process Injection through entry point hijacking
edr-evasion hacking redteam rust windows
Language:Rust 343
Kudaes / Unwinder
Call stack spoofing for Rust
edr-evasion hacking-tool rust
Language:Rust 331
f1zm0 / acheron
indirect syscalls for AV/EDR evasion in Go assembly
adversary-emulation assembly av-evasion edr-bypass edr-evasion evasion go golang malware-research offensive-security red-team red-teaming
Language:Assembly 324
naksyn / PythonMemoryModule
pure-python implementation of MemoryModule technique to load dll and unmanaged exe entirely from memory
edr-evasion evasion hacking memory-module memorymodule python redteam redteam-tools redteaming runpe
Language:Python 313
Kudaes / Split
Apply a divide and conquer approach to bypass EDRs
edr-evasion fork rust windows
Language:Rust 278
VirtualAlllocEx / Payload-Download-Cradles
This are different types of download cradles which should be an inspiration to play and create new download cradles to bypass AV/EPP/EDR in context of download cradle detections.
antivirus-evasion bypass-antivirus bypass-edr edr-evasion payload
Language:PowerShell 257
naksyn / DojoLoader
Generic PE loader for fast prototyping evasion techniques
cobalt-strike edr-evasion evasion pe-loader red-team-tools red-teaming sleep-obfuscation
Language:C 229
VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls
The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls
av-bypass av-evasion direct-syscalls edr-bypass edr-evasion indirect-syscalls shellcode-loader windows-int
Language:C 208
VirtualAlllocEx / Direct-Syscalls-A-journey-from-high-to-low
Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).
av-bypass av-evasion direct-syscalls edr-bypass edr-evasion
Language:C 141
voidvxvt / HellBunny
Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks
direct-syscalls edr-evasion indirect-syscalls maldev malware-development msvc native-api ntapi windows iat-camouflage payload-encryption process-injection edr-bypass api-hashing dll dll-sideloading shellcode-injection shellcode-loader
Language:C 121
x42en / sysplant
Your syscall factory
code-generation hacking-tool syscall-hooking syscalls windows edr-evasion offensive-security
Language:Nim 121
naksyn / Embedder
Embedder is a collection of sources in different languages to embed Python interpreter with minimal dependencies
edr-evasion embedding pyramid redteaming
Language:C++ 118
Offensive-Panda / DefenseEvasionTechniques
This comprehensive and central repository is designed for cybersecurity enthusiasts, researchers, and professionals seeking to stay ahead in the field. It provides a valuable resource for those dedicated to improving their skills in malware development, malware research, offensive security, security defenses and measures.
cyber-threat-intelligence edr-evasion malware-development malware-research offensivesecurity
Language:C++ 117
CroodSolutions / AutoPwnKey
AutoPwnKey is a red teaming framework and testing tool using AutoHotKey (AHK), which at the time of creation proves to be quite evasive. It is our hope that this tool will be useful to red teams over the short term, while over the long term help AV/EDR vendors improve how they handle AHK scripts.
ahk ahk-script attack-simulation av-bypass av-evasion edr-bypass edr-evasion evasion-techniques exploit-code exploit-development exploitation-framework purple-team purpleteam
Language:AutoHotkey 107
oldboy21 / SyscallMeMaybe
Implementation of Indirect Syscall technique to pop a calc.exe
cplusplus edr-evasion security-tools syscalls
Language:C++ 101
oldkingcone / BYOSI
Evade EDR's the simple way, by not touching any of the API's they hook.
edr-bypass edr-evasion php powershell redteam
Language:PHP 93
VirtualAlllocEx / Taskschedule-Persistence-Download-Cradles
Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged
antivirus-evasion bypass-antivirus bypass-edr edr-evasion payload
Language:HTML 87
iamagarre / BadExclusionsNWBO
BadExclusionsNWBO is an evolution from BadExclusions to identify folder custom or undocumented exclusions on AV/EDR
edr-evasion pentesting redteam hacking
Language:C++ 75
0xflux / Rust-Hells-Gate
Rust malware EDR evasion via direct syscalls, fully implemented as an example in Rust
edr-bypass edr-evasion malware malware-research pentest pentest-tool pentesting redteam redteam-tools redteaming rust rust-lang hellsgate offensive-security hells-gate antivirus-bypass antivirus-evasion bypass-antivirus bypass-edr
Language:Rust 64
itaymigdal / PichichiH0ll0wer
Nim process hollowing loader
loader pe-loader penetration-testing penetration-testing-tools process-hollowing process-injection red-team red-team-tools syscalls payload-generator runpe payload-injector edr-bypass edr-evasion
Language:Nim 57
VirtualAlllocEx / DSC_SVC_REMOTE
This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service path, etc. The payload itself can be remotely hosted, downloaded via the wininet library and then executed via direct system calls.
av-bypass av-evasion direct-syscalls edr-bypass edr-evasion
Language:C 54
WafflesExploits / CobaltStrike-YARA-Bypass-f0b627fc
Repository of scripts from my blog post on bypassing the YARA rule Windows_Trojan_CobaltStrike_f0b627fc by generating alternative shellcode sequences.
automatization cobalt-strike edr-bypass edr-evasion python yara-rules
Language:Python 37
k3lpi3b4nsh33 / BlindEdr
A Blind EDR Project for Educational Purposes
driver edr-bypass edr-evasion malware
Language:C 30
0xflux / ETW-Bypass-Rust
Event Tracing for Windows EDR bypass in Rust (usermode)
edr edr-bypass edr-evasion ethical-hacking ethical-hacking-tools etw etw-bypass etw-evasion hacking malware malware-research pentest pentest-tool pentesting red-team redteam redteam-tools redteaming rust
Language:Rust 28
EvilBytecode / Ntdll-Unhook
Unhook Ntdll.dll, Go & C++.
av edr-bypass edr-evasion evasion fud ntdll-unhooking
Language:C++ 21
iamagarre / BadExclusions
BadExclusions is a tool to identify folder custom or undocumented exclusions on AV/EDR
antivirus-evasion edr-evasion pentesting redteam hacking
Language:C 20
EvilBytecode / Nyx-Full-Dll-Unhook
(EDR) Dll Unhooking = kernel32.dll, kernelbase.dll, ntdll.dll, user32.dll, apphelp.dll, msvcrt.dll.
av av-evasion dll-unhooking edr-evasion evasion fud
Language:Go 19
VirtualAlllocEx / Create_Thread_Inline_Assembly_x86
This POC provides the possibilty to execute x86 shellcode in form of a .bin file based on x86 inline assembly
av-bypass av-evasion edr-bypass edr-evasion inline-assembly
Language:C++ 19
x0reaxeax / SilentWrite
PoC arbitrary WPM without a process handle
detection-evasion edr-evasion popcalc redteam remote-write shellcode shellcode-execute windows wpm x86-64 av-evasion edr-bypass injection shellcode-injection shellcode-injector
Language:C 19
melotic / nanostorm
An (WIP) EDR Evasion tool for x64 Windows & Linux binaries that utilizes Nanomites, written in Rust.
edr-bypass edr-evasion obfuscation rust
Language:Rust 18

edr-evasion

Xacone / BestEdrOfTheMarket

klezVirus / SilentMoonwalk

VirtualAlllocEx / DEFCON-31-Syscalls-Workshop

Accenture / Codecepticon

pard0p / CallstackSpoofingPOC

f1zm0 / hades

Kudaes / EPI

Kudaes / Unwinder

f1zm0 / acheron

naksyn / PythonMemoryModule

Kudaes / Split

VirtualAlllocEx / Payload-Download-Cradles

naksyn / DojoLoader

VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls

VirtualAlllocEx / Direct-Syscalls-A-journey-from-high-to-low

voidvxvt / HellBunny

x42en / sysplant

naksyn / Embedder

Offensive-Panda / DefenseEvasionTechniques

CroodSolutions / AutoPwnKey

oldboy21 / SyscallMeMaybe

oldkingcone / BYOSI

VirtualAlllocEx / Taskschedule-Persistence-Download-Cradles

iamagarre / BadExclusionsNWBO

0xflux / Rust-Hells-Gate

itaymigdal / PichichiH0ll0wer

VirtualAlllocEx / DSC_SVC_REMOTE

WafflesExploits / CobaltStrike-YARA-Bypass-f0b627fc

k3lpi3b4nsh33 / BlindEdr

0xflux / ETW-Bypass-Rust

EvilBytecode / Ntdll-Unhook

iamagarre / BadExclusions

EvilBytecode / Nyx-Full-Dll-Unhook

VirtualAlllocEx / Create_Thread_Inline_Assembly_x86

x0reaxeax / SilentWrite

melotic / nanostorm