outflanknl / edr-internalsLinks
Tools for analyzing EDR agents
☆277Updated last year
Alternatives and similar repositories for edr-internals
Users that are interested in edr-internals are comparing it to the libraries listed below
Sorting:
- A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.☆319Updated 2 years ago
- StoneKeeper C2, an experimental EDR evasion framework for research purposes☆208Updated last year
- EDRSandblast-GodFault☆271Updated 2 years ago
- Gain insights into MS-RPC implementations that may be vulnerable using an automated approach and make it easy to visualize the data. By f…☆324Updated 3 months ago
- Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…☆280Updated last year
- Slides & Code snippets for a workshop held @ x33fcon 2024☆282Updated last year
- ☆159Updated last year
- An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution☆194Updated last year
- A Mythic Agent written in PIC C.☆206Updated last year
- ☆189Updated 2 years ago
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆408Updated last month
- A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.☆257Updated 4 months ago
- Windows rootkit designed to work with BYOVD exploits☆214Updated last year
- Exploitation of process killer drivers☆202Updated 2 years ago
- ☆105Updated last year
- A set of programs for analyzing common vulnerabilities in COM☆245Updated last year
- A new technique that can be used to bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders imp…☆339Updated last year
- Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…☆139Updated last year
- AppLocker-Based EDR Neutralization☆289Updated last month
- ☆120Updated 2 years ago
- kernel callback removal (Bypassing EDR Detections)☆211Updated 2 months ago
- IoctlHunter is a command-line tool designed to simplify the analysis of IOCTL calls made by userland software targeting Windows drivers.☆105Updated 2 years ago
- ☆209Updated 2 years ago
- Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.☆165Updated 6 months ago
- ☆301Updated last year
- SHELLSILO is a cutting-edge tool that translates C syntax into syscall assembly and its corresponding shellcode. It streamlines the proce…☆154Updated 6 months ago
- Hide shellcode by shuffling bytes into a random array and reconstruct at runtime☆202Updated 10 months ago
- early cascade injection PoC based on Outflanks blog post☆236Updated last year
- A small program written in C that is designed to load 32/64-bit shellcode and allow for execution or debugging. Can also output PE files …☆169Updated last year
- Detect WFP filters blocking EDR communications☆96Updated 2 years ago