Workshop materials for “Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel” presented at DEF CON 34 and BSidesLV 2026. Covers malware development, EDR Architecture, EDR evasion, C2 customization, and kernel-level techniques.
☆397Aug 16, 2026Updated 2 months ago
Alternatives and similar repositories for edrEvasionWorkshop
Users that are interested in edrEvasionWorkshop are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A compiled language for Windows position-independent x86-64 shellcode and Beacon Object Files.☆322Jun 28, 2026Updated 4 months ago
- A CET-compatible Windows x64 loader that produces fully backed call stacks through runtime function table manipulation, code cave injecti…☆135Sep 6, 2026Updated 2 months ago
- InfraGuard is a Command & Control Redirection Proxy and Manager which protects your Red Team Infrastructure against threat attribution☆334Oct 22, 2026Updated 2 weeks ago
- C2-agnostic BOF collection, categorized by attack chain phase. Designed to be small and modular, allowing for quick execution and automat…☆321Oct 17, 2026Updated 3 weeks ago
- P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an executi…☆247Jul 8, 2026Updated 3 months ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- BingusLdr is a DLL loader built with Crystal Palace that uses a CET compatible stack spoofing technique.☆117Jul 14, 2026Updated 3 months ago
- Windows Kernel-Mode Shellcode Development Framework (WKMSDF)☆91Aug 1, 2026Updated 3 months ago
- A marketplace for LLM skills☆739Updated this week
- ANIMO Azure Network Intel & Mission Ops a C2 based on Azure/Entra assessments☆95Sep 16, 2026Updated last month
- Repository for various Beacon Object Files (BOFs)☆185Oct 22, 2026Updated 2 weeks ago
- AV/EDR evasion via direct and indirect system calls Windows NT 3.1 through Windows 11 24H2 · x64 · x86 · WoW64 · ARM64☆637Oct 24, 2026Updated 2 weeks ago
- Collection of reversed vulnerable drivers weaponized into process killers. PPL won't save you.☆115Oct 18, 2026Updated 2 weeks ago
- Sleep replacement that executes real, varied work to break behavioral pattern matching by EDR and anti-cheat systems☆91Jul 20, 2026Updated 3 months ago
- EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response)☆77Oct 18, 2026Updated 2 weeks ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, S…☆144Aug 13, 2026Updated 2 months ago
- DynLoader A modular Windows loader focused on EDR evasion Built with indirect syscall (Tartarus Gate / Hell’s Gate), Manual PE parsing …☆82Jul 10, 2026Updated 3 months ago
- This repo contains the results of an internal re-write of impacket I undertook at my current company. It contains some of the IoCs found …☆360Sep 7, 2026Updated 2 months ago
- Erebus is an Initial Access wrapper for the Mythic Command & Control Server. It converts shellcode into payloads specifically used for ph…☆241Sep 13, 2026Updated last month
- Evasion kit for Cobalt Strike☆510Updated this week
- Proof of Concept for Process Code Injection Without Using WriteProcessMemory☆160Sep 27, 2026Updated last month
- Conquest is a feature-rich and malleable command & control/post-exploitation framework developed in Nim.☆428Oct 27, 2026Updated last week
- Custom Adaptix-compatible C2 agent - PIC beacon + Stardust UDRL + Go extender plugins☆154Oct 29, 2026Updated last week
- Gain shellcode execution via T4 Text Transform files/TextTransoform.exe☆87Oct 23, 2026Updated 2 weeks ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Tailscale/Headscale C2 profile and agent for Mythic☆35Mar 14, 2026Updated 7 months ago
- Hidden Desktop Plugin For Havoc C2,Soon coming for Sliver.☆265Sep 29, 2026Updated last month
- A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Slee…☆113Jul 26, 2026Updated 3 months ago
- Deep insights into EDR detection approaches☆104Updated this week
- A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive …☆1,565May 5, 2026Updated 6 months ago
- AV/EDR Lab environment setup references to help in Malware development☆474Feb 19, 2025Updated last year
- A Position Independent Code (PIC) implementation of the execute-assembly command built with Crystal Palace.☆22Oct 4, 2026Updated last month
- Passive backdoor implant that sniffs for a covert magic-packet trigger and runs tasks written in a custom 23-opcode bytecode command lang…☆57Aug 26, 2026Updated 2 months ago
- Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advance…☆119Sep 17, 2026Updated last month
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Pass-the-Passkey Family of Attacks☆234Sep 14, 2026Updated last month
- Attack path mapping for Active Directory, ADCS, SCCM, and MSSQL using BloodHound CE + OpenGraph data.☆247Aug 9, 2026Updated 2 months ago
- NØW is a word-based shellcode encoding and obfuscation tool that transforms raw shellcode bytes into natural-looking English prose.☆92Jun 24, 2026Updated 4 months ago
- Windows protocol library, including SMB and RPC implementations, among others.☆846Oct 5, 2026Updated last month
- Sleep Obfuscation via CreateThreadpoolTimer☆24Jul 27, 2026Updated 3 months ago
- ☆92Sep 19, 2026Updated last month
- A foundational C library for building operationally credible offensive capabilities☆95Sep 21, 2026Updated last month