outflanknl / edr-internals
Tools for analyzing EDR agents
☆221Updated 9 months ago
Alternatives and similar repositories for edr-internals:
Users that are interested in edr-internals are comparing it to the libraries listed below
- A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.☆308Updated last year
- Slides & Code snippets for a workshop held @ x33fcon 2024☆255Updated 9 months ago
- ☆149Updated 3 months ago
- An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution☆183Updated 3 months ago
- StoneKeeper C2, an experimental EDR evasion framework for research purposes☆194Updated 2 months ago
- Collect Windows telemetry for Maldev☆316Updated last month
- Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…☆141Updated 8 months ago
- Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…☆257Updated 6 months ago
- DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely☆347Updated 3 months ago
- ☆186Updated last year
- comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reducti…☆195Updated 9 months ago
- A Mythic Agent written in PIC C.☆183Updated last month
- EDRSandblast-GodFault☆257Updated last year
- ☆105Updated 8 months ago
- Red teaming tool to dump LSASS memory, bypassing basic countermeasures.☆206Updated 2 months ago
- Detect EDR's exceptions by inspecting processes' loaded modules☆130Updated last year
- An interactive shell to spoof some LOLBins command line☆184Updated last year
- A set of programs for analyzing common vulnerabilities in COM☆199Updated 6 months ago
- Windows rootkit designed to work with BYOVD exploits☆169Updated 2 months ago
- Find potential DLL Sideloads on your windows computer☆176Updated 2 months ago
- Local & remote Windows DLL Proxying☆162Updated 9 months ago
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆335Updated last month
- Sleep obfuscation☆210Updated 3 months ago
- Interactive Shell and Command Execution over Named-Pipes (SMB) for Fileless lateral movement☆159Updated 3 months ago
- Exploitation of process killer drivers☆198Updated last year
- A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.☆181Updated last year