Alternatives and similar repositories for Learning-EDR-and-EDR_Evasion:

Users that are interested in Learning-EDR-and-EDR_Evasion are comparing it to the libraries listed below

• An0nUD4Y / AV-EDR-Lab-Environment-Setup
  AV/EDR Lab environment setup references to help in Malware development
  ☆363Updated 2 months ago
• Offensive-Panda / ProcessInjectionTechniques
  This comprehensive process injection series is crafted for cybersecurity enthusiasts, researchers, and professionals who aim to stay at t…
  ☆356Updated 2 months ago
• RedefiningReality / Cobalt-Strike
  Various resources to enhance Cobalt Strike's functionality and its ability to evade antivirus/EDR detection
  ☆274Updated 8 months ago
• Helixo32 / CrimsonEDR
  Simulate the behavior of AV/EDR for malware development training.
  ☆460Updated last year
• Helixo32 / NimBlackout
  Kill AV/EDR leveraging BYOVD attack
  ☆336Updated last year
• Maldev-Academy / MaldevAcademyLdr.1
  ☆338Updated last year
• senzee1984 / Amsi_Bypass_In_2023
  Amsi Bypass payload that works on Windwos 11
  ☆375Updated last year
• WesleyWong420 / RedTeamOps-Havoc-101
  Materials for the workshop "Red Team Ops: Havoc 101"
  ☆365Updated 4 months ago
• ph4nt0mbyt3 / Darkside
  C# AV/EDR Killer using less-known driver (BYOVD)
  ☆159Updated last year
• rasta-mouse / OST-C2-Spec
  Open Source C&C Specification
  ☆232Updated this week
• dobin / avred
  Analyse your malware to surgically obfuscate it
  ☆450Updated 3 weeks ago
• logangoins / Krueger
  Proof of Concept (PoC) .NET tool for remotely killing EDR with WDAC
  ☆331Updated last month
• mandiant / msi-search
  ☆270Updated last year
• ajm4n / DLLHound
  Find potential DLL Sideloads on your windows computer
  ☆174Updated last month
• logangoins / Cable
  .NET post-exploitation toolkit for Active Directory reconnaissance and exploitation
  ☆268Updated 3 months ago
• rtecCyberSec / Packer_Development
  Slides & Code snippets for a workshop held @ x33fcon 2024
  ☆250Updated 8 months ago
• rad9800 / BootExecuteEDR
  ☆343Updated 2 months ago
• ricardojoserf / TrickDump
  Dump lsass using only NTAPI functions creating 3 JSON and 1 ZIP file... and generate the MiniDump file later!
  ☆421Updated last week
• Meowmycks / LetMeowIn
  A sophisticated, covert Windows-based credential dumper using C++ and MASM x64.
  ☆383Updated 7 months ago
• deepinstinct / ContainYourself
  A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.
  ☆307Updated last year
• deepinstinct / NoFilter
  ☆296Updated 3 months ago
• Maldev-Academy / ExecutePeFromPngViaLNK
  Extract and execute a PE embedded within a PNG file using an LNK file.
  ☆355Updated 3 months ago
• WesleyWong420 / OPSEC-Tradecraft
  Collection of OPSEC Tradecraft and TTPs for Red Team Operations
  ☆283Updated 2 weeks ago
• BlackSnufkin / Invoke-DumpMDEConfig
  PowerShell script to dump Microsoft Defender Config, protection history and Exploit Guard Protection History (no admin privileges requir…
  ☆141Updated 8 months ago
• vxCrypt0r / Voidgate
  A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes (such as msfve…
  ☆509Updated 8 months ago
• OtterHacker / Conferences
  ☆297Updated 3 months ago
• senzee1984 / EDRPrison
  Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry
  ☆379Updated 6 months ago
• ricardojoserf / NativeDump
  Dump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!)
  ☆565Updated last month
• netero1010 / GhostTask
  A tool employs direct registry manipulation to create scheduled tasks without triggering the usual event logs.
  ☆516Updated last month
• mertdas / PrivKit
  PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.
  ☆386Updated 8 months ago