outflanknl / edr-internalsLinks
Tools for analyzing EDR agents
☆276Updated last year
Alternatives and similar repositories for edr-internals
Users that are interested in edr-internals are comparing it to the libraries listed below
Sorting:
- A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.☆319Updated 2 years ago
- Slides & Code snippets for a workshop held @ x33fcon 2024☆278Updated last year
- Gain insights into MS-RPC implementations that may be vulnerable using an automated approach and make it easy to visualize the data. By f…☆324Updated 3 months ago
- Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…☆278Updated last year
- StoneKeeper C2, an experimental EDR evasion framework for research purposes☆207Updated last year
- ☆159Updated last year
- A set of programs for analyzing common vulnerabilities in COM☆243Updated last year
- ☆105Updated last year
- EDRSandblast-GodFault☆270Updated 2 years ago
- ☆189Updated last year
- Windows rootkit designed to work with BYOVD exploits☆211Updated last year
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆402Updated last week
- An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution☆194Updated last year
- SHELLSILO is a cutting-edge tool that translates C syntax into syscall assembly and its corresponding shellcode. It streamlines the proce…☆153Updated 5 months ago
- ☆119Updated last year
- A new technique that can be used to bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders imp…☆337Updated last year
- Bypass Credential Guard by patching WDigest.dll using only NTAPI functions☆263Updated 9 months ago
- Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…☆139Updated last year
- kernel callback removal (Bypassing EDR Detections)☆210Updated 2 months ago
- ☆301Updated last year
- ☆259Updated 2 years ago
- early cascade injection PoC based on Outflanks blog post☆236Updated last year
- ShellWasp is a tool to help build shellcode that utilizes Windows syscalls, while overcoming the portability problem associated with Wind…☆170Updated 2 years ago
- Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.☆164Updated 5 months ago
- Native Syscalls Shellcode Injector☆267Updated 2 years ago
- A Mythic Agent written in PIC C.☆205Updated 11 months ago
- Open Source C&C Specification☆278Updated 10 months ago
- DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely☆380Updated last year
- AppLocker-Based EDR Neutralization☆272Updated last month
- IoctlHunter is a command-line tool designed to simplify the analysis of IOCTL calls made by userland software targeting Windows drivers.☆105Updated 2 years ago