TierZeroSecurity / edr_blocker
Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination IP addresses are parsed based on the server name in TLS Client Hello packet and the provided blocked server name (or blocked string) list in the file.
☆141Updated 9 months ago
Alternatives and similar repositories for edr_blocker:
Users that are interested in edr_blocker are comparing it to the libraries listed below
- ☆154Updated 4 months ago
- Two in one, patch lifetime powershell console, no more etw and amsi!☆88Updated last week
- Windows Persistence IT-Security☆97Updated last month
- ☆154Updated 9 months ago
- This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone…☆198Updated 6 months ago
- NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg☆46Updated last year
- PoC for using MS Windows printers for persistence / command and control via Internet Printing☆148Updated last year
- Stage 0☆159Updated 4 months ago
- Port of Cobalt Strike's Process Inject Kit☆173Updated 5 months ago
- Adversary Emulation Framework☆98Updated 9 months ago
- .NET Post-Exploitation Utility for Abusing Explicit Certificate Mappings in ADCS☆143Updated 2 months ago
- Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …☆103Updated last month
- A variation of ProcessOverwriting to execute shellcode on an executable's section☆148Updated last year
- An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution☆187Updated 5 months ago
- GregsBestFriend process injection code created from the White Knight Labs Offensive Development course☆189Updated last year
- Construct the payload at runtime using an array of offsets☆63Updated 10 months ago
- ☆105Updated last month
- Lateral Movement☆123Updated last year
- ☆171Updated 5 months ago
- SHELLSILO is a cutting-edge tool that translates C syntax into syscall assembly and its corresponding shellcode. It streamlines the proce…☆132Updated 6 months ago
- Interactive Shell and Command Execution over Named-Pipes (SMB) for Fileless lateral movement☆164Updated 5 months ago
- Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.☆92Updated this week
- A BOF to enumerate system process, their protection levels, and more.☆116Updated 5 months ago
- comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reducti…☆198Updated 10 months ago
- Ghosting-AMSI☆159Updated last week
- Identify common EDR processes, directories, and services. Simple BOF of Invoke-EDRChecker.☆121Updated 7 months ago
- A Mythic agent for Windows written in C☆120Updated 2 weeks ago
- Just another C2 Redirector using CloudFlare. Support multiple C2 and multiple domains. Support for websocket listener.☆157Updated last month
- ☆106Updated 2 months ago
- Example code samples from our ScriptBlock Smuggling Blog post☆90Updated 10 months ago