EDRception

Vedi: https://malwaretech.com/2023/12/silly-edr-bypasses-and-where-to-find-them.html...

attack_monitor

Attack Monitor Attack Monitor ist eine Python-Anwendung, die entwickelt wurde, um die Sicherheitsüberwachungsfähigkeiten von Windows 7/2008 und allen späteren Versionen Workstations/Servern zu verbessern und die dynamische Analyse von Malware zu automatisieren. Aktuelle Modi gegenseitig...

vortex

🚩 Questo è il repository pubblico di vortex, per l'ultima versione e gli aggiornamenti ti invitiamo a supportarci tramite https://porchetta.industries/ Vortex VPN Overall Reconnaissance, Testing, Enumeration and Exploitation Toolkit 🚩 Sponsor Se desideri sponsorizzare questo progetto e avere gli...

GoPurple

GoPurple Este projeto é uma simples coleção de várias técnicas de injeção de shellcode, com o objetivo de simplificar o processo de avaliação de detecção de endpoint, além de me desafiar a entrar no mundo do Golang. Instalação 1 - Requer o go instalado. 2 - Compile a aplicação a partir do diretór...

EventHorizon

EventHorizon EventHorizon ist ein Tool, das Sicherheitsanalysten und/oder Forschern mit Event Tracing for Windows ETW-Telemetrie ausstatten soll, die in Verbindung mit sigma-ähnlichen Regeln robuste Endpunkterkennungs- und Reaktionsfähigkeiten ermöglicht. Allerdings ist EventHorizon keinesfalls e...

attack_monitor

Attack Monitor Attack Monitor is Python application written to enhance security monitoring capabilites of Windows 7/2008 and all later versions workstations/servers and to automate dynamic analysis of malware. Current modes mutually exclusive: Endpoint detection ED Malware analysis on dedicated...

clawdstrike

Clawdstrike EDR per l'età dello sciame. Fail closed. Firma la verità. Stato: beta pre-1.0. Le API pubbliche sono stabili; le impostazioni predefinite potrebbero ancora essere irrigidite prima della 1.0. Clawdstrike è un motore di policy, un EDR e una catena di audit firmata tutto in un unico...

rustinel

Rustinel Open-Source-Endpunkterkennung für Windows, Linux und macOS. Native Telemetrie für Sigma, YARA, IOC-Erkennung und SIEM-fähige Warnmeldungen. Geschrieben in Rust. Webseite | Dokumentation | Herunterladen | SIEM-Demos Schnellstart Rustinel wird mit Release-Archiven ausgeliefert, die eine...

APTSimulator

APT Simulator Importante: Non scaricare semplicemente ZIP o clonare il repository se non prevedi di sviluppare qualche test. Usa il pacchetto nella release che contiene una versione impacchettata con archivi crittografati che non contengono campioni e strumenti in chiaro. APT Simulator è uno scri...

JSAnalyzer

JS Analyzer - Estensione Burp Suite di Jensec https://x.com/jensec Una potente estensione Burp Suite per l'analisi statica di JavaScript. Estrae endpoint API, URL, segreti e indirizzi email da file JavaScript con un intelligente filtraggio del rumore. L'obiettivo è ridurre il rumore il più...

Your Automated Pentest Looks Clean. See What It Missed in This Expert Webinar

Your pentest report looks clean. That might be the problem. Run automated pentesting long enough, and the new findings start to dry up. By the third or fourth run, fewer issues appear. The report looks stable. Leadership reads "stable" as "secure." It usually isn't. The work slows down. The risk...

PT-2026-48154

The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a cryptographic hash of data bytes truncate the hashed data if it exceeds 4GB. This leads to an integer wrap-around if the data is larger than the maximum unsigned integer value 32-bit. Attackers could create a collidi...

Closing the Sim-To-Real Gap: An Evaluation Framework for Autonomous Cyber Defense Configuration of Commercial EDR

Leading commercial endpoint detection and response EDR products have shifted from operator-configured rule sets to multi-component systems where autonomous AI components operate alongside, and increasingly in place of, operator-deployed policies. Autonomous defense agents using commercial EDR as...

How Leading Organizations Are Turning EDR Into Operational Resilience

Most organizations now recognize that endpoint protection alone is no longer sufficient. That's why adoption of endpoint detection and response EDR has accelerated rapidly in recent years. Organizations understand that modern attacks move faster, evade traditional prevention controls, and require...

Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection

As threats become more coordinated and faster to execute, endpoint protection has become the proving ground for modern defense. For the seventh consecutive time, Microsoft has been named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. We believe this reflects both the...

From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. References 4. Learn more Microsoft Defender Experts identified an active cryptojacking campaign in which malicious download sites are surfaced not only through traditional search engine poisoning, but also through A...

Converge Connect: Unlock Lower Premiums with Proven Qualys Security

Key Takeaways Qualys, in collaboration with Converge, has launched an offering that ties your security posture to your cyber insurance costs. The Qualys Converge Connect Insurance Report CCIR supplements manual insurance questionnaires with objective, platform-generated, real-time security data...

Your Cloud Detection Strategy in 2026: What to Expect at the Global Cybersecurity Summit

Cloud environments have changed how security teams detect and respond to threats. Signals come from more places, identities are harder to track, and attacks rarely stay within a single system. For many teams, the challenge is no longer visibility. It is having the risk context to understand what...

The agentic SOC—Rethinking SecOps for the next decade

Every major shift in cyberattacker behavior over the past decade has followed a meaningful shift in how defenders operate. When security operation centers SOCs deployed endpoint detection and response EDR—and later extended detection and response XDR—security teams raised the bar, pushing...

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

Threat actors associated with Qilin and Warlock ransomware operations have been observed using the bring your own vulnerable driver BYOVD technique to silence security tools running on compromised hosts, according to findings from Cisco Talos and Trend Micro. Qilin attacks analyzed by Talos have...