Alternatives and similar repositories for vEDR

Users that are interested in vEDR are comparing it to the libraries listed below

• jdu2600 / CFG-FindHiddenShellcode
  Walks the CFG bitmap to find previously executable but currently hidden shellcode regions
  ☆130Updated 2 years ago
• jdu2600 / Etw-SyscallMonitor
  Monitors ETW for security relevant syscalls maintaining the set called by each unique process
  ☆87Updated 2 years ago
• YoavLevi / IAT-Tracer
  An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…
  ☆124Updated last year
• connormcgarr / EATGuard
  Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)
  ☆115Updated 2 years ago
• t-tani / defender2yara
  Convert Microsoft Defender Antivirus Signatures (VDM) into YARA rules
  ☆141Updated this week
• m417z / thread-call-stack-scanner
  Safely manage the unloading of DLLs that have been hooked into a process. Context: https://github.com/KNSoft/KNSoft.SlimDetours/discussio…
  ☆81Updated 7 months ago
• keowu / InstrumentationCallbackToolKit
  A fast method to intercept syscalls from any user-mode process using InstrumentationCallback and detect any process using Instrumentation…
  ☆38Updated 2 years ago
• WithSecureLabs / GarbageMan
  GarbageMan is a set of tools for analyzing .NET binaries through heap analysis.
  ☆118Updated 2 years ago
• joe-desimone / patriot
  ☆152Updated 3 years ago
• jdu2600 / EtwTi-FluctuationMonitor
  Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections
  ☆164Updated 2 years ago
• rad9800 / VehApiResolve
  ☆117Updated 3 years ago
• rbmm / NtDetours
  Detours implementation (x64/x86) which used only ntdll import
  ☆90Updated 3 months ago
• gabriellandau / ShadowStackWalk
  Finding Truth in the Shadows
  ☆120Updated 3 years ago
• mrexodia / lolbin-poc
  Small PoC of using a Microsoft signed executable as a lolbin.
  ☆141Updated 2 years ago
• jdu2600 / API-To-ETW
  Uses ghidra to find all ETW write metadata for each API in a PE file
  ☆24Updated last year
• Dump-GUY / sc2pe
  Simple dotnet Native AOT app that uses AsmResolver to convert shellcode to PE
  ☆66Updated 2 years ago
• knight0x07 / BumbleCrypt
  A Bumblebee-inspired Crypter
  ☆79Updated 3 years ago
• DebugPrivilege / WindowsAP1
  Code samples that serve as references for Windows API functions
  ☆77Updated last year
• thefLink / Hunt-Weird-Syscalls
  ETW based POC to identify direct and indirect syscalls
  ☆190Updated 2 years ago
• ihack4falafel / ROR13HashGenerator
  C# implementation to produce ROR-13 numeric hash for given function API name
  ☆34Updated 6 years ago
• alfarom256 / MCP-PoC
  Minifilter Callback Patching Proof-of-Concept
  ☆73Updated 3 years ago
• RedTeamOperations / VEH-PoC
  ☆120Updated 3 years ago
• pathtofile / PPLRunner
  Run Processes as PPL with ELAM
  ☆175Updated 3 years ago
• hasherezade / sig_finder
  Signature finder (from PE-bear)
  ☆39Updated 5 months ago
• xenoscr / manual-syscall-detect
  A tool for detecting manual/direct syscalls in x86 and x64 processes using Nirvana Hooks.
  ☆116Updated 3 years ago
• waldo-irc / MalMemDetect
  Detect strange memory regions and DLLs
  ☆184Updated 4 years ago
• hasherezade / pe_unmapper
  Small tool to convert beteween the PE alignments (raw and virtual).
  ☆109Updated 3 years ago
• cod3nym / Deobfuscar
  A simple commandline application to automatically decrypt strings from Obfuscator protected binaries
  ☆47Updated last year
• hasherezade / shellc_encoder
  Standalone Metasploit-like XOR encoder for shellcode
  ☆50Updated last year
• micREsoft / SysCaller
  SysCaller: SDK for WindowsAPI via syscalls. Dynamic Resolution, Obfuscation, Multi-Language Bindings, & more!
  ☆51Updated 2 months ago