Tools

cenobyte-vincit/xspawn

Spawns macOS programs through launchd's private XPC interface without execing them, making EDR record launchd as parent. Supports one-shot,…

xforcered/bokuloader

A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!

bc-security/empire

Encrypted C2 and post-exploitation framework for red teams, with modular PowerShell/Python/C#/Go agents, many offensive modules, and easy…

es3n1n/no-defender

A slightly more fun way to disable windows defender + firewall. (through the WSC api)

netero1010/edrsilencer

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

saadahla/filelesspeloader

Loading Remote AES Encrypted PE in memory , Decrypted it and run it

zeromemoryex/blackout

kill anti-malware protected processes ( BYOVD )

maldev-academy/hellhall

Performing Indirect Clean Syscalls

helviojunior/hookchain

HookChain: A new perspective for Bypassing EDR Solutions

withsecurelabs/callstackspoofer

A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)

joasasantos/syswhispers4

AV/EDR evasion via direct and indirect system calls Windows NT 3.1 through Windows 11 24H2 · x64 · x86 · WoW64 · ARM64

s12cybersecurity/windefenderkiller

Windows Defender Killer | Registry-Based Disablement + BYOVD Process Termination (C++)

rasta-mouse/crystal-kit

Evasion kit for Cobalt Strike

senzee1984/edrprison

Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry

pard0p/callstackspoofingpoc

C++ self-Injecting dropper based on various EDR evasion techniques.

xyrem/hyperdeceit

HyperDeceit is the ultimate all-in-one library that emulates Hyper-V for Windows, giving you the ability to intercept and manipulate operating system…

kudaes/unwinder

Call stack spoofing for Rust

senzee1984/amsi_bypass_in_2023

Amsi Bypass payload that works on Windwos 11