Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination IP addresses are parsed based on the server name in TLS Client Hello packet and the provided blocked server name (or blocked string) list in the file.
☆139Jul 23, 2024Updated 2 years ago
Alternatives and similar repositories for edr_blocker
Users that are interested in edr_blocker are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆30Jul 26, 2024Updated 2 years ago
- Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry☆477Aug 2, 2024Updated 2 years ago
- Generic PE loader for fast prototyping evasion techniques☆246Jul 2, 2024Updated 2 years ago
- ☆98Sep 1, 2024Updated 2 years ago
- Dump lsass using only NTAPI functions creating 3 JSON and 1 ZIP file... and generate the MiniDump file later!☆610Aug 17, 2026Updated last month
- Open source password manager - Proton Pass • AdSecurely store, share, and autofill your credentials with Proton Pass, the end-to-end encrypted password manager trusted by millions.
- ☆146Oct 29, 2024Updated last year
- ApexLdr is a DLL Payload Loader written in C☆116Jul 17, 2024Updated 2 years ago
- Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …☆311Jul 31, 2024Updated 2 years ago
- ☆110Aug 21, 2024Updated 2 years ago
- Remotely Enumerate sessions using undocumented Windows Station APIs☆116Aug 21, 2024Updated 2 years ago
- A new technique that can be used to bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders imp…☆358Oct 7, 2024Updated 2 years ago
- A command and control framework written in rust.☆389Aug 12, 2026Updated last month
- Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.☆293May 27, 2024Updated 2 years ago
- Positional Independent Code to extract clear text password from mstsc.exe using API Hooking via HWBP.☆249Jun 11, 2024Updated 2 years ago
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- Identify common EDR processes, directories, and services. Simple BOF of Invoke-EDRChecker.☆134Oct 4, 2024Updated 2 years ago
- Proxll is a tool designed to simplify the generation of proxy DLLs while addressing common conflicts related to windows.h☆41Oct 8, 2024Updated 2 years ago
- BOF and Python3 implementation of technique to unbind 445/tcp on Windows via SCM interactions☆360Nov 19, 2024Updated last year
- ☆121Oct 9, 2023Updated 3 years ago
- Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.☆324Apr 12, 2024Updated 2 years ago
- Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths☆366Aug 11, 2024Updated 2 years ago
- Section-based payload obfuscation technique for x64☆63Aug 8, 2024Updated 2 years ago
- ☆126Sep 1, 2024Updated 2 years ago
- A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes (such as msfve…☆597Jun 12, 2024Updated 2 years ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- HookChain: A new perspective for Bypassing EDR Solutions☆613Jan 5, 2025Updated last year
- An EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer☆556Feb 13, 2024Updated 2 years ago
- Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird …☆809Jan 26, 2026Updated 8 months ago
- ☆51Jun 12, 2026Updated 3 months ago
- DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely☆395Dec 13, 2024Updated last year
- Local & remote Windows DLL Proxying☆171Jun 17, 2024Updated 2 years ago
- A VSCode plugin to assist with BOF development.☆36Aug 14, 2024Updated 2 years ago
- A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.☆316Aug 31, 2023Updated 3 years ago
- Execute commands in other Sessions☆93Jul 29, 2024Updated 2 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Inject DLLs into the explorer process using icons☆415May 18, 2025Updated last year
- TypeLib persistence technique☆151Oct 22, 2024Updated last year
- ☆60Oct 24, 2024Updated last year
- A POC to disable TamperProtection and other Defender / MDE components☆259Jun 6, 2024Updated 2 years ago
- Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …☆102Mar 27, 2025Updated last year
- Process injection alternative☆404Sep 6, 2024Updated 2 years ago
- Slides and Codes used for the workshop Red Team Infrastructure Automation☆192Apr 14, 2024Updated 2 years ago