EDR/AV Simulation for Malware Development
☆12Oct 21, 2023Updated 3 years ago
Alternatives and similar repositories for MaldevEDR
Users that are interested in MaldevEDR are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A single byte modification in the kernel memory bypasses and disables all core functions of the AV/EDR security solutions☆18Aug 26, 2025Updated last year
- Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle…☆15Jan 7, 2023Updated 3 years ago
- Slides and POC demo for my talk at Divizion Zero on EDR evasion titled "Evasion Adventures"☆31Jan 14, 2023Updated 3 years ago
- This project is an EDRSandblast fork, adding some features and custom pieces of code.☆16Jan 10, 2024Updated 2 years ago
- BadExclusions is a tool to identify folder custom or undocumented exclusions on AV/EDR☆21Feb 8, 2024Updated 2 years ago
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …☆102Mar 27, 2025Updated last year
- Just a git repo for the sleepmask detection rule i found in https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-…☆16Jun 4, 2025Updated last year
- ☆43Feb 18, 2025Updated last year
- .NET profiler DLL loading can be abused to make a legit .NET application load a malicious DLL using environment variables. This exploit i…☆51Jul 29, 2024Updated 2 years ago
- Bypassing AV, EDR, Application Whitelisting and ASR Rules☆13Apr 18, 2023Updated 3 years ago
- Small utility package for manipulating Windows process tokens☆24Apr 26, 2022Updated 4 years ago
- Simple PoC to locate hooked functions by EDR in ntdll.dll☆45Jul 16, 2023Updated 3 years ago
- Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.☆41Jul 9, 2023Updated 3 years ago
- DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly☆67Mar 19, 2024Updated 2 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- A stealthy, assembly-based tool for secure function address resolution, offering a robust alternative to GetProcAddress.☆74Mar 6, 2024Updated 2 years ago
- Golang 写的免杀框架，通过系统调用等手法bypass AV/EDR☆23Jul 11, 2024Updated 2 years ago
- ☆12Nov 12, 2023Updated 2 years ago
- Run shellcode in memory of node.exe (or electron app)☆13Jul 28, 2023Updated 3 years ago
- A tool that bypasses Windows Defender by manually loading DLLs, parsing EAT directly, and updating IAT with unhooked functions to run M…☆21Jul 14, 2024Updated 2 years ago
- some AV / EDR / analysis studies☆10May 21, 2023Updated 3 years ago
- ☆14Oct 10, 2024Updated 2 years ago
- Windows capability development using GCC and GNU Make☆23Nov 1, 2025Updated last year
- Direct syscalls Injection to bypass AV/EDR☆10May 18, 2024Updated 2 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- XSSPawn is a flexible and customizable visitor bot for CTF challenges setup; mostly used as a CTF XSS Bot. Based on CTFTraining's base_im…☆13Jul 28, 2025Updated last year
- Longue vue is an exploit chain that can compromise over the internet NETGEAR DGND3700v2 devices.☆26Mar 15, 2022Updated 4 years ago
- PlanqX EDR is an open-source, advanced Endpoint Detection and Response (EDR) solution for Windows, offering real-time system and network …☆33Jul 10, 2026Updated 3 months ago
- This POC provides the possibilty to execute x86 shellcode in form of a .bin file based on x86 inline assembly☆20Apr 17, 2023Updated 3 years ago
- This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for loc…☆55May 8, 2023Updated 3 years ago
- Bypass EDR(Endpoint Detection and Response) environment to write Behinder jsp webshell onto webserver☆13Dec 27, 2023Updated 2 years ago
- Hidedump:a lsassdump tools that may bypass EDR☆51May 23, 2024Updated 2 years ago
- ETWhat is a Windows utility that determines whether Event Tracing for Windows (ETW) providers operate in kernel mode or user mode.☆10Jun 9, 2025Updated last year
- Rex Shellcode Loader for AV/EDR evasion☆36Apr 7, 2024Updated 2 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- An emulator for a single-instruction CPU, the instruction is NOR.☆16Apr 20, 2012Updated 14 years ago
- Set the process mitigation policy for loading only Microsoft Modules , and block any userland 3rd party modules☆41May 6, 2023Updated 3 years ago
- BloodyAv is Custom Shell Code loader to Bypass Av and Edr.☆16Mar 21, 2022Updated 4 years ago
- Shellcode Loader Implementing Indirect Dynamic Syscall , API Hashing, Fileless Shellcode retrieving using Winsock2☆13Jul 15, 2023Updated 3 years ago
- Transparently call NTAPI via Halo's Gate with indirect syscalls.☆13Apr 26, 2024Updated 2 years ago
- Dynamic Identification and Recognition Technology☆11Nov 1, 2016Updated 10 years ago
- ROP gadget-based sleep obfuscation technique☆14Aug 10, 2025Updated last year