EDRs
mr-un1k0d3r/edrsRed team tool for EDR evasion: dynamically resolves syscall IDs, patches ntdll stubs, unhooks IAT hooks, and lists hooked APIs from major EDR vendors.
binary-analysiscurated-resourcesids-ips-evasion+3
2.2k
mr-un1k0d3r/edrsRed team tool for EDR evasion: dynamically resolves syscall IDs, patches ntdll stubs, unhooks IAT hooks, and lists hooked APIs from major EDR vendors.
thewover/donutGenerates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs…
netero1010/edrsilencerA tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.
m00nrise/processhiderPost-exploitation tool for hiding processes from monitoring applications
reveng007/darkwidowIndirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a…
malwaretech/edr-preloaderAn EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer
tiliondev/fortressStealth Chromium engine that stops scrapers and browser agents from getting blocked, with one line of code change.
cryptolok/ghostinthenetUltimate Network Stealther that makes Linux a Ghost In The Net and protects from MITM/DOS/scan
senzee1984/edrprisonLeverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry
saadahla/d1rkldrShellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscall…
robertdavidgraham/isowallThis is a mini-firewall that completely isolates a target device from the local network.
d4rksystem/vboxcloakA PowerShell script that attempts to help malware analysts hide their Windows VirtualBox Windows VM's from malware that may be trying to evade…
mgeeky/stracciatellaOpSec-safe Powershell runspace from within C# (aka SharpPick) with AMSI, Constrained Language Mode and Script Block Logging disabled at startup
codextf2/burp2malleableQuick python utility I wrote to turn HTTP requests from burp suite into Cobalt Strike Malleable C2 profiles
rsmudge/unhook-bofRemove API hooks from a Beacon process.
saadahla/ntdllreflectionBypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle to ntdll ,…
twosevenonet/edrchokerA tool uses the QoS Policy (Pacer.sys) to throttle Endpoint Detection and Response (EDR) agents from connecting to the server.
teler-sh/teler-wafteler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets,…