Alternatives and similar repositories for vEDR

Users that are interested in vEDR are comparing it to the libraries listed below

• jdu2600 / CFG-FindHiddenShellcode
  Walks the CFG bitmap to find previously executable but currently hidden shellcode regions
  ☆126Updated 2 years ago
• jdu2600 / Etw-SyscallMonitor
  Monitors ETW for security relevant syscalls maintaining the set called by each unique process
  ☆85Updated 2 years ago
• keowu / InstrumentationCallbackToolKit
  A fast method to intercept syscalls from any user-mode process using InstrumentationCallback and detect any process using Instrumentation…
  ☆32Updated 2 years ago
• mrexodia / lolbin-poc
  Small PoC of using a Microsoft signed executable as a lolbin.
  ☆139Updated 2 years ago
• m417z / thread-call-stack-scanner
  Safely manage the unloading of DLLs that have been hooked into a process. Context: https://github.com/KNSoft/KNSoft.SlimDetours/discussio…
  ☆78Updated 4 months ago
• jdu2600 / EtwTi-FluctuationMonitor
  Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections
  ☆149Updated 2 years ago
• connormcgarr / EATGuard
  Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)
  ☆114Updated 2 years ago
• rbmm / NtDetours
  Detours implementation (x64/x86) which used only ntdll import
  ☆89Updated 3 weeks ago
• t-tani / defender2yara
  Convert Microsoft Defender Antivirus Signatures (VDM) into YARA rules
  ☆132Updated this week
• xenoscr / manual-syscall-detect
  A tool for detecting manual/direct syscalls in x86 and x64 processes using Nirvana Hooks.
  ☆115Updated 3 years ago
• YoavLevi / IAT-Tracer
  An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…
  ☆120Updated last year
• loneicewolf / KernelMode-Code
  2022 Updated Kernelmode-Code
  ☆33Updated last year
• knight0x07 / BumbleCrypt
  A Bumblebee-inspired Crypter
  ☆78Updated 2 years ago
• redt1de / MaldevEDR
  EDR/AV Simulation for Malware Development
  ☆13Updated 2 years ago
• Dump-GUY / sc2pe
  Simple dotnet Native AOT app that uses AsmResolver to convert shellcode to PE
  ☆66Updated 2 years ago
• alfarom256 / MCP-PoC
  Minifilter Callback Patching Proof-of-Concept
  ☆72Updated 3 years ago
• scrt / KexecDDPlus
  Exploiting the KsecDD Windows driver through Server Silos
  ☆75Updated 11 months ago
• hasherezade / sig_finder
  Signature finder (from PE-bear)
  ☆38Updated 2 months ago
• hasherezade / pe_unmapper
  Small tool to convert beteween the PE alignments (raw and virtual).
  ☆105Updated 2 years ago
• joe-desimone / patriot
  ☆148Updated 3 years ago
• gabriellandau / ShadowStackWalk
  Finding Truth in the Shadows
  ☆115Updated 2 years ago
• jdu2600 / API-To-ETW
  Uses ghidra to find all ETW write metadata for each API in a PE file
  ☆23Updated last year
• DebugPrivilege / WindowsAP1
  Code samples that serve as references for Windows API functions
  ☆35Updated last year
• AlSch092 / HideStaticReferences
  Research into removing strings & API call references at compile-time (Anti-Analysis)
  ☆28Updated last year
• CognisysGroup / SweetDreams
  Implementation of Advanced Module Stomping and Heap/Stack Encryption
  ☆219Updated 2 years ago
• rad9800 / VehApiResolve
  ☆114Updated 3 years ago
• Dor00tkit / BamExtensionTableHook
  Proof-of-concept kernel driver that hijacks the Windows kernel extension table mechanism to preserve process notify callbacks even when a…
  ☆92Updated 4 months ago
• thefLink / Hunt-Weird-Syscalls
  ETW based POC to identify direct and indirect syscalls
  ☆187Updated 2 years ago
• XaFF-XaFF / ZwProcessHollowing
  ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption
  ☆90Updated 2 years ago
• m417z / LdrDllNotificationHook
  Hook all callbacks which are registered with LdrRegisterDllNotification
  ☆90Updated 7 months ago