1006 matches found
CrimsonEDR
CrimsonEDR root@kitploit: / | | | | \ | | | | | | | | | | | | | '| | ' / |/ | ' | | | | | | / | || | | | | | | | \ \ | | | | || || | | \ \ || ||| || ||//|| |||/|| \ Developed by : Matthias Ossard https://github.com/Helixo32 CrimsonEDR is an open-source project engineered to identify specific...
NTDLL-Unhook
NTDLL Unhook proper ntdll .text section unhooking via native api. x86/x64/wow64 supported. How It Works The program walks the PEB to locate ntdll.dll base address and manually parses the PE export table to resolve NT API functions without touching the Import Address Table. It then uses NtOpenFile...
laurel
Linux Audit – Usable, Robust, Easy Logging LAUREL is an event post-processing plugin for auditd8 that generates useful, enriched JSON-based audit logs suitable for modern security monitoring setups. Documentation corresponding to the latest stable release can be found here. Why? TLDR: Instead of...
LoadReload
LoadReload Shellcode Loader based on what i did for my Master Thesis, designed for Sliver-Shellcode smaller than 25MB..... !Note Features: Multibyte-XOR Decryption of Payload Fetches Payload locally Anti-Emulation by BusySleep-Function via KUSERSHAREDDATA RW-RX-Loop for EDR-Deconditioning / Wasti...
EDR-Redir
EDR-Redir EDR-Redir uses a Bind Filter mini filter bindflt.sys to redirect the Endpoint Detection and Response EDR 's working folder to a folder of the attacker's choice. Alternatively, it can make the folder appear corrupt to prevent the EDR's process services from functioning. Command Line Synt...
lutlol
Living Under the Land on Linux Material for talks with the same name at... BSides Belfast 2025 BSides Vienna 2025 The code isn't particularly usable as-is, but may be useful for reference. Helpful things: The src/ directory - Source code for most of the things in the talk ProcrastinationEDR -...
BYOSI
BYOSI Evade EDR's the simple way, by not touching any of the API's they hook. Theory I've noticed that most EDRs fail to scan scripting files, treating them merely as text files. While this might be unfortunate for them, it's an opportunity for us to profit. Flashy methods like residing in memory...
SharpEDRChecker
SharpEDRChecker New and improved C Implementation of Invoke-EDRChecker. Checks running processes, process metadata, Dlls loaded into your current process and each DLLs metadata, common install directories, installed services and each service binaries metadata, installed drivers and each drivers...
iMonitor
中文 Introduction iMonitor Endpoint Behavior Analysis System is a endpoint behavior monitoring and analysis software based on iMonitorSDK. Provides monitoring of system behaviors such as processes, files, registry, and networks. Support extensions and scripts, you can easily customize and add more...
Phantom-Evasion-Loader
SROP-Assisted Cross-Memory Attach CMA Injection via Direct Syscalls. 👻 Phantom-Evasion-Loader x64 Linux Phantom-Evasion-Loader is a standalone, pure x64 Assembly injection engine engineered to minimize the detection surface of modern EDR/XDR solutions and Kernel-level monitors like Falco eBPF. It...
Skrull
Skrull Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted. It...
faxhell
faxhell "Fax Shell" Fax サービスと Ualapi.dll に基づく DLL ハイジャックを使用した Proof-of-Concept のバインドシェル。 詳細は次の記事をご覧ください: https://windows-internals.com/faxing-your-way-to-system/ How to use Ualapi.dll をビルドし、c:\windows\system32 に配置します。 Fax サービスを起動すると、DLL が読み込まれ、エクスポート UalStart が呼び出されます。UalStart...
faxhell
faxhell "Fax Shell" A Proof-of-Concept bind shell using the Fax service and a DLL hijack based on Ualapi.dll. See our writeup at: https://windows-internals.com/faxing-your-way-to-system/ How to use Build Ualapi.dll and place in c:\windows\system32 Start the Fax service, which will load the DLL an...
HashDump-BypassEDR
1 Project Overview By leveraging the extended capabilities of the system whitelisted program Reg.exe, we cleverly bypass the interception points of antivirus software, achieving the goal of bypassing EDR to dump hashes. According to actual testing, this method is effective against Windows-series...
openedr
OpenEDR We at OpenEDR believe in creating a cybersecurity platform with its source code openly available to the public, where products and services can be provisioned and managed together. EDR is our starting point. OpenEDR is a full-blown EDR capability. It is one of the most sophisticated,...
EDR-Telemetry
EDR Telemetry 📖 About A comprehensive comparison of telemetry features from EDR products and endpoint agents like Sysmon. This project enables security practitioners to evaluate telemetry capabilities while promoting vendor transparency. 🌐 Visit our Website for the complete comparison and analysi...
xspawn
xspawn xspawn starts a program on macOS through launchd and never execs that program itself. The aim is that an EDR records launchd as the parent, not this tool or the calling shell. by cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/xspawn Summary xspawn opens...
ZipExec
ZipExec ZipExec is a Proof-of-Concept POC tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected...
shad0w
SHAD0W SHAD0W は、成熟した環境で正常に動作するように設計されたモジュール式 C2 フレームワークです。 EDR や AV を回避するためのさまざまな手法を使用し、オペレーターは使い慣れたツールやトレードクラフトを引き続き使用できます。Python 3.8 と C で動作し、ペイロード生成には Donut を使用します。Donut と SHAD0W のプロセスインジェクション機能を組み合わせることで、オペレーターは .NET アセンブリ、DLL、EXE、JS、VBS、XSL を完全にメモリ内で実行できます。ユーザーランド API フッキングを回避するために動的に解決される...